Edit tour

Windows Analysis Report
z68ORDER.scr.exe

Overview

General Information

Sample name:	z68ORDER.scr.exe
Analysis ID:	1507912
MD5:	a04e6ee334556cebd31e9ae152ddbed1
SHA1:	68dbddadad1c6c40b8f824ee44726fea87118fcc
SHA256:	5c875f9d28eae5afce4aac472b0825edef8cac3119d2991d3dd08a1fd32bd424
Tags:	exescr
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

z68ORDER.scr.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\z68ORDER.scr.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

powershell.exe (PID: 7672 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7948 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

z68ORDER.scr.exe (PID: 7688 cmdline: "C:\Users\user\Desktop\z68ORDER.scr.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

z68ORDER.scr.exe (PID: 7712 cmdline: "C:\Users\user\Desktop\z68ORDER.scr.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

z68ORDER.scr.exe (PID: 7732 cmdline: "C:\Users\user\Desktop\z68ORDER.scr.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

mpTrle.exe (PID: 8116 cmdline: "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

mpTrle.exe (PID: 8160 cmdline: "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

mpTrle.exe (PID: 6388 cmdline: "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

mpTrle.exe (PID: 7380 cmdline: "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe" MD5: A04E6EE334556CEBD31E9AE152DDBED1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "us2.smtp.mailhostbox.com", "Username": "wethem@aklaneah-sa.com", "Password": "Password:  )NYyffR0   "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2546108508.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2545303921.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2546108508.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1525325777.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1525325777.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1525325777.0000000002E89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2545303921.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2545303921.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2546108508.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2546108508.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2545303921.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1525325777.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z68ORDER.scr.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z68ORDER.scr.exe PID: 7492	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: z68ORDER.scr.exe PID: 7492	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z68ORDER.scr.exe PID: 7732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z68ORDER.scr.exe PID: 7732	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: mpTrle.exe PID: 8116	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: mpTrle.exe PID: 8160	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: mpTrle.exe PID: 8160	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: mpTrle.exe PID: 6388	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: mpTrle.exe PID: 7380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: mpTrle.exe PID: 7380	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.mpTrle.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.mpTrle.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.mpTrle.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339d0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a42:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33acc:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b5e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bc8:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c3a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cd0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d60:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z68ORDER.scr.exe.39cbc58.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z68ORDER.scr.exe.39cbc58.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z68ORDER.scr.exe.39cbc58.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31bd0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31c42:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31ccc:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31d5e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31dc8:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31e3a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ed0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31f60:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z68ORDER.scr.exe.3990c38.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z68ORDER.scr.exe.3990c38.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z68ORDER.scr.exe.3990c38.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31bd0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31c42:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31ccc:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31d5e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31dc8:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31e3a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ed0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31f60:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339d0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e7f0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a42:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e862:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33acc:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e8ec:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b5e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e97e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bc8:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e9e8:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c3a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ea5a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cd0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6eaf0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d60:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6eb80:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339d0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e9f0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa9810:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a42:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ea62:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa9882:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33acc:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6eaec:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa990c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b5e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eb7e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa999e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bc8:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ebe8:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9a08:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c3a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ec5a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9a7a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cd0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ecf0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9b10:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z68ORDER.scr.exe", ParentImage: C:\Users\user\Desktop\z68ORDER.scr.exe, ParentProcessId: 7492, ParentProcessName: z68ORDER.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe", ProcessId: 7672, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\z68ORDER.scr.exe, ProcessId: 7732, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mpTrle

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\z68ORDER.scr.exe, Initiated: true, ProcessId: 7732, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49715

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z68ORDER.scr.exe", ParentImage: C:\Users\user\Desktop\z68ORDER.scr.exe, ParentProcessId: 7492, ParentProcessName: z68ORDER.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe", ProcessId: 7672, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "us2.smtp.mailhostbox.com", "Username": "wethem@aklaneah-sa.com", "Password": "Password: )NYyffR0 "}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Virustotal: Detection: 33%			Perma Link

Multi AV Scanner detection for submitted file

Source: z68ORDER.scr.exe	ReversingLabs: Detection: 34%
Source: z68ORDER.scr.exe	Virustotal: Detection: 33%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: z68ORDER.scr.exe

Joe Sandbox ML: detected

Source: z68ORDER.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.11:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.11:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.11:49726 version: TLS 1.2

Source: z68ORDER.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: befV.pdbSHA256r source: z68ORDER.scr.exe, mpTrle.exe.7.dr
Source:	Binary string: befV.pdb source: z68ORDER.scr.exe, mpTrle.exe.7.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.11:49715 -> 208.91.198.143:587

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.11:49715 -> 208.91.198.143:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: us2.smtp.mailhostbox.com

Source: z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558716244.00000000060CF000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1532698130.0000000006732000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558716244.00000000060CF000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558716244.00000000060CF000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1532698130.0000000006732000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0A
Source: z68ORDER.scr.exe, 00000000.00000002.1320773433.0000000002969000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 00000009.00000002.1440089925.0000000002EA9000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000C.00000002.1523574938.000000000287D000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E89000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: z68ORDER.scr.exe, 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: z68ORDER.scr.exe, 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.11:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.11:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.11:49726 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, 3DlgK9re6m.cs	.Net Code: sIJKyc
Source: 0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack, 3DlgK9re6m.cs	.Net Code: sIJKyc

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.mpTrle.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z68ORDER.scr.exe.3990c38.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: z68ORDER.scr.exe

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_00FED5BC	0_2_00FED5BC
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_04DB7750	0_2_04DB7750
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_04DB0040	0_2_04DB0040
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_04DB0007	0_2_04DB0007
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_04DB7740	0_2_04DB7740
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_04DBBC43	0_2_04DBBC43
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A8E320	0_2_06A8E320
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A88AA8	0_2_06A88AA8
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A8A1B8	0_2_06A8A1B8
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A881E0	0_2_06A881E0
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A881D1	0_2_06A881D1
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A87DA8	0_2_06A87DA8
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A87D98	0_2_06A87D98
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A89888	0_2_06A89888
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A87970	0_2_06A87970
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A87957	0_2_06A87957
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_011CB308	7_2_011CB308
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_011CAB40	7_2_011CAB40
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_011C4AD0	7_2_011C4AD0
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_011C3EB8	7_2_011C3EB8
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_011C4200	7_2_011C4200
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_067CC520	7_2_067CC520
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_067CAEFC	7_2_067CAEFC
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_06822780	7_2_06822780
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_068255C8	7_2_068255C8
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_068265E0	7_2_068265E0
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_0682C568	7_2_0682C568
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_0682B220	7_2_0682B220
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_06825CE8	7_2_06825CE8
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_06827D68	7_2_06827D68
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_06827688	7_2_06827688
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_0682E788	7_2_0682E788
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_06820007	7_2_06820007
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_06820040	7_2_06820040
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_02E2D5BC	9_2_02E2D5BC
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_05437750	9_2_05437750
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_05430040	9_2_05430040
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_05430006	9_2_05430006
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_05437740	9_2_05437740
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_0702DDD8	9_2_0702DDD8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_0702A1B8	9_2_0702A1B8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_070281E0	9_2_070281E0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_07027DA8	9_2_07027DA8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_07029888	9_2_07029888
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074DA15F	9_2_074DA15F
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074DA170	9_2_074DA170
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074DDE38	9_2_074DDE38
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_02C24AD0	10_2_02C24AD0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_02C2EAD8	10_2_02C2EAD8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_02C23EB8	10_2_02C23EB8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_02C24200	10_2_02C24200
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_02C2AD08	10_2_02C2AD08
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069BACDC	10_2_069BACDC
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069B96B0	10_2_069B96B0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069BDBF0	10_2_069BDBF0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069D3490	10_2_069D3490
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069D55D0	10_2_069D55D0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069D65E8	10_2_069D65E8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069DB220	10_2_069DB220
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069DC178	10_2_069DC178
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069D7D70	10_2_069D7D70
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069D7690	10_2_069D7690
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069DE398	10_2_069DE398
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069D0040	10_2_069D0040
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069D5CDF	10_2_069D5CDF
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_0263D5BC	12_2_0263D5BC
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_04C67750	12_2_04C67750
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_04C60040	12_2_04C60040
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_04C60007	12_2_04C60007
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_04C67740	12_2_04C67740
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_052CDDD8	12_2_052CDDD8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_052C8AA8	12_2_052C8AA8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_052CA1B8	12_2_052CA1B8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_052C81E0	12_2_052C81E0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_052C7DA8	12_2_052C7DA8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_052C793E	12_2_052C793E
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 12_2_052C9888	12_2_052C9888
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_02A34200	13_2_02A34200
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_02A34AD0	13_2_02A34AD0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_02A3EAD8	13_2_02A3EAD8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_02A33EB8	13_2_02A33EB8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_02A3AD08	13_2_02A3AD08
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066FACDC	13_2_066FACDC
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066F96B0	13_2_066F96B0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066FDBFB	13_2_066FDBFB
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_06703490	13_2_06703490
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_067065E8	13_2_067065E8
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_067055D0	13_2_067055D0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_0670B230	13_2_0670B230
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_0670C178	13_2_0670C178
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_06707D70	13_2_06707D70
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_06707690	13_2_06707690
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_0670E398	13_2_0670E398
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_06700040	13_2_06700040
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_06705CF0	13_2_06705CF0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_0670001F	13_2_0670001F
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_06700007	13_2_06700007

Source: z68ORDER.scr.exe, 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename64af20ca-f267-4570-b8a1-6b375e9c5566.exe4 vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1320773433.000000000297D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1325062760.0000000005170000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1326999884.0000000006D70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1320773433.0000000002969000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename64af20ca-f267-4570-b8a1-6b375e9c5566.exe4 vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1320773433.0000000002993000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1317755984.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000000.00000002.1320773433.0000000002901000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe, 00000007.00000002.2542231438.00000000009C8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs z68ORDER.scr.exe
Source: z68ORDER.scr.exe	Binary or memory string: OriginalFilenamebefV.exeN vs z68ORDER.scr.exe

Source: z68ORDER.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.mpTrle.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z68ORDER.scr.exe.3990c38.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: z68ORDER.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, slKb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, mAKJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, xQRSe0Fg.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, n3rhMa.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, MQzE4FWn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, nSmgRyX5a1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, jsLdnKeIcMR46DDMhl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, jsLdnKeIcMR46DDMhl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/9@2/2

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z68ORDER.scr.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mw2fwdi2.m3a.ps1

Jump to behavior

Source: z68ORDER.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z68ORDER.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z68ORDER.scr.exe	ReversingLabs: Detection: 34%
Source: z68ORDER.scr.exe	Virustotal: Detection: 33%

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

File read: C:\Users\user\Desktop\z68ORDER.scr.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: z68ORDER.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z68ORDER.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: z68ORDER.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: befV.pdbSHA256r source: z68ORDER.scr.exe, mpTrle.exe.7.dr
Source:	Binary string: befV.pdb source: z68ORDER.scr.exe, mpTrle.exe.7.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: z68ORDER.scr.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	.Net Code: CfiaETEDsX System.Reflection.Assembly.Load(byte[])
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	.Net Code: CfiaETEDsX System.Reflection.Assembly.Load(byte[])

Source: z68ORDER.scr.exe

Static PE information: 0xFF39ACF5 [Wed Sep 9 20:05:09 2105 UTC]

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_00FE9C40 push C8027D93h; iretd	0_2_00FE9C6D
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_00FE9C20 push C8027D93h; iretd	0_2_00FE9C6D
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A8D16E push es; ret	0_2_06A8D174
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 0_2_06A8793E push es; retf A877h	0_2_06A87954
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_011C0C55 push edi; retf	7_2_011C0C7A
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_067C4F00 push esp; retf	7_2_067C4F0D
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Code function: 7_2_067C588F push es; ret	7_2_067C5890
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_02E25E0A pushfd ; iretd	9_2_02E25E19
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_02E29C61 push C8053993h; iretd	9_2_02E29C6D
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074D1688 push eax; iretd	9_2_074D1689
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074D0527 push FFFFFF8Bh; iretd	9_2_074D0529
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074DE384 push ds; retf	9_2_074DE387
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074D1260 push esp; retf	9_2_074D12E9
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074D12E2 push esp; retf	9_2_074D12E9
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074D0D92 pushad ; retf	9_2_074D0DA1
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 9_2_074D4C49 push 780542F5h; iretd	9_2_074D4C55
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_02C20C55 push edi; retf	10_2_02C20C7A
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069B53E0 push es; ret	10_2_069B53F0
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 10_2_069BFEF9 push es; retf	10_2_069BFEFC
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_02A30C55 push edi; retf	13_2_02A30C7A
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066F85F8 push ss; retf	13_2_066F85FA
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066F858B push ss; retf	13_2_066F8592
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066F8588 push ss; retf	13_2_066F858A
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066F8251 push cs; retf	13_2_066F8252
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066F81B1 push cs; retf	13_2_066F81B2
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066F8181 push cs; retf	13_2_066F8182
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066FADAF push ecx; retf 0006h	13_2_066FADBA
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066FADBF push ecx; retf 0006h	13_2_066FADCA
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066FED88 push eax; retf	13_2_066FED92
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066FE903 push eax; retf	13_2_066FE90A
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Code function: 13_2_066FE900 push eax; retf	13_2_066FE902

Source: z68ORDER.scr.exe

Static PE information: section name: .text entropy: 7.850671263446786

Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, dWktre6SEl2SD8D3hGe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dN1rGpbakK', 'gmFryfuiDk', 'giZrxZJnB2', 'SAlrX11k9i', 'e3tro3giX9', 'LuorKC0G9k', 't5LrObbMwY'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, vg8sasKIPGHmhif1OC.cs	High entropy of concatenated method names: 'UQcNhr9qHn', 'TK0NBM6jyy', 'Np3294LoWg', 'x6Z26Msapq', 'tATNVHLPil', 'KENNpode5M', 'NuUNTfA9YJ', 'ArgNGvWdvY', 'rxQNyIWjFf', 'sZPNxChwxy'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, NIishf6qk0DcA9LexFc.cs	High entropy of concatenated method names: 'QXkrQcIbk0', 'l1UrP3Edyu', 'DdxrElXRwa', 'qTgNiDFeyjfsmWGD84A', 'gne36rFqNymdEvsFsHx', 'Hp6HlMFYEHoGO3xXWDc', 'LVQnq8FZKt2OUsuqt9s'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, DxBFYMqtM6hl4HetuK.cs	High entropy of concatenated method names: 'lYgEZP3MV', 'nVmv6DFlr', 'Qw4fwSa1e', 'aylsAIZS9', 'BrdcstqiR', 'BF7JY14HJ', 'IOa7pej5WnO0O9w0vn', 'c3F2JYhoha9ufFI6rm', 'NAH2eupXj', 'MvIrvnMI3'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	High entropy of concatenated method names: 'CNwSLuq0cF', 'AHfSFhXVYZ', 'IR7S8FnqFE', 'UkQSWM4yl2', 'vtuSRCGarC', 'amfSC2jEb4', 'fBwS11bfiK', 'nkxS4tXQaf', 'UnHSZwN89J', 'C06Sd4TxYq'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, DmQhGwiPicP2QJ6WXW.cs	High entropy of concatenated method names: 'kDV1F40qd4', 'Lxb1W2ubko', 'PkN1C1KqWM', 'qmgCBt9NDC', 'iMkCz698pE', 'KFA19h63lt', 'xXN162IPrv', 'PXL1qlFice', 'tfM1S9W8Vu', 'rsp1atfDTS'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, vuE4LvaIEDGTZI5pvQ.cs	High entropy of concatenated method names: 'lG161sLdnK', 'XcM64R46DD', 'Fys6dXY1ee', 'QpE6tXbebQ', 'UTk6lWUY7L', 'Fhf657oNOI', 'dleNH7WKLQACxZmjVr', 'Y6qE1v2ZPqmOMDWZtQ', 'TeV66kg5EK', 'oeB6SK2RWU'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, ihdDFM7LfSDIFZy3OO.cs	High entropy of concatenated method names: 'sR81QIuJhy', 'APO1P6b2kP', 'RCW1E6cGtb', 'eRA1vJ1MLC', 'RP11mnOOpT', 'oC11ft48HW', 'o6U1scbwgG', 'oBF1eCG109', 'xaI1cHkS4o', 'qUY1JsooqO'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, jsLdnKeIcMR46DDMhl.cs	High entropy of concatenated method names: 'IcR8GGvQ7V', 'eui8ys48u4', 'VDy8xM0FXs', 'gwh8Xkr7cE', 'DLb8oxRPfy', 'vCG8K4Sn6y', 'vKy8OU9RK7', 'P8s8hwPyNC', 'qJU8ImVxv8', 'zev8BGHZ8o'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, lW6hafzrDrkg3FckJ0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hYyU3unnss', 'zKYUlrYWr8', 'MR4U5gqRva', 'q0YUN4emUi', 'LJuU24QMjl', 'iykUU3bba5', 'yAAUrYQ1nq'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, MebQhaJGjo6pLoTkWU.cs	High entropy of concatenated method names: 'mCnRmeoCHA', 'k23Rs0Pq5u', 'f8IWjLjib0', 'qpgWuPG7uc', 'dehWMocj22', 'cdZW0pp5S2', 'LwNWi9p4G2', 'jqsWbYJegn', 'EJWW7lubTf', 'iTLWD8lx0B'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, FGXur1TCVU5a0ZPpW9.cs	High entropy of concatenated method names: 'yNF3eJydEX', 'bGU3cE5DTO', 'V8s3kS66aZ', 'o7f3nEyWGT', 'xOg3u7SxJC', 'HFo3M1PwZ2', 'S8K3iculg0', 'xTo3brBAHV', 'bIM3DlYIFF', 'WA23VZjLdX'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, amAd90hqHLq47wcWBA.cs	High entropy of concatenated method names: 'YYY2FobhQq', 'N3M28cQBel', 'r5m2Wx0ltQ', 'Exm2Rht8LR', 'WiM2CNZpUn', 'er121Asss4', 'A8H24phREm', 'yl82ZtlAuU', 'iRc2dcrrl2', 'aS92t4qiMu'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, pZDAEa69iNvXYYB9Qwy.cs	High entropy of concatenated method names: 'iwvUQHVhWv', 'KIfUPnT3vK', 'Qq4UEgPcqG', 'coCUv10GtN', 'iW0UmxG8mI', 'rsuUflLVaR', 'PTVUsULNfq', 'kV6UeZxfg8', 'AgfUcZ7Pt0', 'NTlUJpRCf5'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, fvtIhYxFwnvgHyg39B.cs	High entropy of concatenated method names: 'ToString', 'xGN5Vqc9iy', 'f5Z5nEw4nI', 'lGX5jZrkcD', 'hI85uE9kSL', 'Ad75MuZcRI', 'IOf50Sb2HT', 'GG35iHGmqi', 'ARm5bJ59pn', 'eU657dWcnh'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, hiQgtPuGlgF8Rbms0T.cs	High entropy of concatenated method names: 'e4xCAvPFww', 'lppCQwR0qg', 'wIFCEU5GoE', 'DqdCv1ek8o', 'KnHCfPj5y3', 'b7rCspRW7b', 'nexCcWwIPT', 'vYBCJ6kYrD', 'vrJrQBtG9RoSICEFThk', 'JVMmGFtSeYER32aU2hm'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, uYDe3JcysXY1eeTpEX.cs	High entropy of concatenated method names: 'uGxWvYQXkt', 'HxuWfwRFG3', 'qtXWeVuogx', 'gBHWcM4YlM', 'SeMWl9D4L1', 'G5eW53pIox', 'JQuWNZ4gXd', 'rAvW2SwGwv', 'wwKWUb0qWt', 'WY3WrFKFCh'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, rcLuWpIfHAd4gVs5Yj.cs	High entropy of concatenated method names: 'lih2kkSCDN', 'GI82nb4BC9', 'Iod2jlMrFC', 'cjf2uQEX4i', 'P7r2GZXHO2', 'SUV2MFKPJk', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, Lix3e3B7qxWaq0NNDb.cs	High entropy of concatenated method names: 'qYsU6aas5Y', 'YnZUStUypS', 'MdKUajUHiV', 'r59UFI8x2I', 'uJXU8fVmLF', 'IhkURwp2UU', 'ijaUCvBqJh', 'zBC2O4f91I', 'PSK2h3CsHm', 'zut2Ixc6RG'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, gxlfI78xVO1oZG8f74.cs	High entropy of concatenated method names: 'Dispose', 'qhf6Io2WJn', 'WvlqnpmYiN', 'tuQFFutNro', 'q6m6BAd90q', 'vLq6z47wcW', 'ProcessDialogKey', 'YA2q9cLuWp', 'BHAq6d4gVs', 'pYjqqiix3e'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, w7LJhfk7oNOIHoA3aF.cs	High entropy of concatenated method names: 'O8wCLA6hko', 'DKxC8JP06d', 'RWECRoCKE3', 'z7IC1dDO2s', 'oMuC4WaDhx', 'xc3RolGFNv', 'GOXRK2ydaj', 'V3vROlgLDF', 'zyvRhradv6', 'O8gRIYMugB'
Source: 0.2.z68ORDER.scr.exe.6d70000.7.raw.unpack, acCfZnGC0hTeE98x1E.cs	High entropy of concatenated method names: 'ImUlDMu61K', 'iwjlp1Y5w6', 'a0nlGVVmcn', 'xXNlyDamqQ', 'Fd5lnxbseD', 'WTEljKAkTH', 'B7rlu8SIEW', 'CZtlMnIFBa', 'Huol0KZIvc', 'SGplilG7UL'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, dWktre6SEl2SD8D3hGe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dN1rGpbakK', 'gmFryfuiDk', 'giZrxZJnB2', 'SAlrX11k9i', 'e3tro3giX9', 'LuorKC0G9k', 't5LrObbMwY'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, vg8sasKIPGHmhif1OC.cs	High entropy of concatenated method names: 'UQcNhr9qHn', 'TK0NBM6jyy', 'Np3294LoWg', 'x6Z26Msapq', 'tATNVHLPil', 'KENNpode5M', 'NuUNTfA9YJ', 'ArgNGvWdvY', 'rxQNyIWjFf', 'sZPNxChwxy'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, NIishf6qk0DcA9LexFc.cs	High entropy of concatenated method names: 'QXkrQcIbk0', 'l1UrP3Edyu', 'DdxrElXRwa', 'qTgNiDFeyjfsmWGD84A', 'gne36rFqNymdEvsFsHx', 'Hp6HlMFYEHoGO3xXWDc', 'LVQnq8FZKt2OUsuqt9s'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, DxBFYMqtM6hl4HetuK.cs	High entropy of concatenated method names: 'lYgEZP3MV', 'nVmv6DFlr', 'Qw4fwSa1e', 'aylsAIZS9', 'BrdcstqiR', 'BF7JY14HJ', 'IOa7pej5WnO0O9w0vn', 'c3F2JYhoha9ufFI6rm', 'NAH2eupXj', 'MvIrvnMI3'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, CYMPDo4J6Cy7nmhfYl.cs	High entropy of concatenated method names: 'CNwSLuq0cF', 'AHfSFhXVYZ', 'IR7S8FnqFE', 'UkQSWM4yl2', 'vtuSRCGarC', 'amfSC2jEb4', 'fBwS11bfiK', 'nkxS4tXQaf', 'UnHSZwN89J', 'C06Sd4TxYq'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, DmQhGwiPicP2QJ6WXW.cs	High entropy of concatenated method names: 'kDV1F40qd4', 'Lxb1W2ubko', 'PkN1C1KqWM', 'qmgCBt9NDC', 'iMkCz698pE', 'KFA19h63lt', 'xXN162IPrv', 'PXL1qlFice', 'tfM1S9W8Vu', 'rsp1atfDTS'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, vuE4LvaIEDGTZI5pvQ.cs	High entropy of concatenated method names: 'lG161sLdnK', 'XcM64R46DD', 'Fys6dXY1ee', 'QpE6tXbebQ', 'UTk6lWUY7L', 'Fhf657oNOI', 'dleNH7WKLQACxZmjVr', 'Y6qE1v2ZPqmOMDWZtQ', 'TeV66kg5EK', 'oeB6SK2RWU'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, ihdDFM7LfSDIFZy3OO.cs	High entropy of concatenated method names: 'sR81QIuJhy', 'APO1P6b2kP', 'RCW1E6cGtb', 'eRA1vJ1MLC', 'RP11mnOOpT', 'oC11ft48HW', 'o6U1scbwgG', 'oBF1eCG109', 'xaI1cHkS4o', 'qUY1JsooqO'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, jsLdnKeIcMR46DDMhl.cs	High entropy of concatenated method names: 'IcR8GGvQ7V', 'eui8ys48u4', 'VDy8xM0FXs', 'gwh8Xkr7cE', 'DLb8oxRPfy', 'vCG8K4Sn6y', 'vKy8OU9RK7', 'P8s8hwPyNC', 'qJU8ImVxv8', 'zev8BGHZ8o'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, lW6hafzrDrkg3FckJ0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hYyU3unnss', 'zKYUlrYWr8', 'MR4U5gqRva', 'q0YUN4emUi', 'LJuU24QMjl', 'iykUU3bba5', 'yAAUrYQ1nq'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, MebQhaJGjo6pLoTkWU.cs	High entropy of concatenated method names: 'mCnRmeoCHA', 'k23Rs0Pq5u', 'f8IWjLjib0', 'qpgWuPG7uc', 'dehWMocj22', 'cdZW0pp5S2', 'LwNWi9p4G2', 'jqsWbYJegn', 'EJWW7lubTf', 'iTLWD8lx0B'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, FGXur1TCVU5a0ZPpW9.cs	High entropy of concatenated method names: 'yNF3eJydEX', 'bGU3cE5DTO', 'V8s3kS66aZ', 'o7f3nEyWGT', 'xOg3u7SxJC', 'HFo3M1PwZ2', 'S8K3iculg0', 'xTo3brBAHV', 'bIM3DlYIFF', 'WA23VZjLdX'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, amAd90hqHLq47wcWBA.cs	High entropy of concatenated method names: 'YYY2FobhQq', 'N3M28cQBel', 'r5m2Wx0ltQ', 'Exm2Rht8LR', 'WiM2CNZpUn', 'er121Asss4', 'A8H24phREm', 'yl82ZtlAuU', 'iRc2dcrrl2', 'aS92t4qiMu'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, pZDAEa69iNvXYYB9Qwy.cs	High entropy of concatenated method names: 'iwvUQHVhWv', 'KIfUPnT3vK', 'Qq4UEgPcqG', 'coCUv10GtN', 'iW0UmxG8mI', 'rsuUflLVaR', 'PTVUsULNfq', 'kV6UeZxfg8', 'AgfUcZ7Pt0', 'NTlUJpRCf5'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, fvtIhYxFwnvgHyg39B.cs	High entropy of concatenated method names: 'ToString', 'xGN5Vqc9iy', 'f5Z5nEw4nI', 'lGX5jZrkcD', 'hI85uE9kSL', 'Ad75MuZcRI', 'IOf50Sb2HT', 'GG35iHGmqi', 'ARm5bJ59pn', 'eU657dWcnh'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, hiQgtPuGlgF8Rbms0T.cs	High entropy of concatenated method names: 'e4xCAvPFww', 'lppCQwR0qg', 'wIFCEU5GoE', 'DqdCv1ek8o', 'KnHCfPj5y3', 'b7rCspRW7b', 'nexCcWwIPT', 'vYBCJ6kYrD', 'vrJrQBtG9RoSICEFThk', 'JVMmGFtSeYER32aU2hm'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, uYDe3JcysXY1eeTpEX.cs	High entropy of concatenated method names: 'uGxWvYQXkt', 'HxuWfwRFG3', 'qtXWeVuogx', 'gBHWcM4YlM', 'SeMWl9D4L1', 'G5eW53pIox', 'JQuWNZ4gXd', 'rAvW2SwGwv', 'wwKWUb0qWt', 'WY3WrFKFCh'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, rcLuWpIfHAd4gVs5Yj.cs	High entropy of concatenated method names: 'lih2kkSCDN', 'GI82nb4BC9', 'Iod2jlMrFC', 'cjf2uQEX4i', 'P7r2GZXHO2', 'SUV2MFKPJk', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, Lix3e3B7qxWaq0NNDb.cs	High entropy of concatenated method names: 'qYsU6aas5Y', 'YnZUStUypS', 'MdKUajUHiV', 'r59UFI8x2I', 'uJXU8fVmLF', 'IhkURwp2UU', 'ijaUCvBqJh', 'zBC2O4f91I', 'PSK2h3CsHm', 'zut2Ixc6RG'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, gxlfI78xVO1oZG8f74.cs	High entropy of concatenated method names: 'Dispose', 'qhf6Io2WJn', 'WvlqnpmYiN', 'tuQFFutNro', 'q6m6BAd90q', 'vLq6z47wcW', 'ProcessDialogKey', 'YA2q9cLuWp', 'BHAq6d4gVs', 'pYjqqiix3e'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, w7LJhfk7oNOIHoA3aF.cs	High entropy of concatenated method names: 'O8wCLA6hko', 'DKxC8JP06d', 'RWECRoCKE3', 'z7IC1dDO2s', 'oMuC4WaDhx', 'xc3RolGFNv', 'GOXRK2ydaj', 'V3vROlgLDF', 'zyvRhradv6', 'O8gRIYMugB'
Source: 0.2.z68ORDER.scr.exe.3b119d0.3.raw.unpack, acCfZnGC0hTeE98x1E.cs	High entropy of concatenated method names: 'ImUlDMu61K', 'iwjlp1Y5w6', 'a0nlGVVmcn', 'xXNlyDamqQ', 'Fd5lnxbseD', 'WTEljKAkTH', 'B7rlu8SIEW', 'CZtlMnIFBa', 'Huol0KZIvc', 'SGplilG7UL'

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

File created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

Jump to dropped file

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mpTrle			Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mpTrle			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

File opened: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe:Zone.Identifier read attributes | delete

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: z68ORDER.scr.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 8116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 6388, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 88C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 98C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 9AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: AAC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 11C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory allocated: 2A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 4E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 8A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 9A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 9C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: AC30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 4E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 25F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2810000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 8260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 9260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 9440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: A440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2C30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory allocated: 2990000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6079	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3603	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Window / User API: threadDelayed 3482	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Window / User API: threadDelayed 1796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Window / User API: threadDelayed 1586	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Window / User API: threadDelayed 3489	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Window / User API: threadDelayed 945
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Window / User API: threadDelayed 4331

Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7992	Thread sleep count: 3482 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7992	Thread sleep count: 1796 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99545s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98669s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -98063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -97143s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe TID: 7944	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 8140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7044	Thread sleep count: 1586 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7044	Thread sleep count: 3489 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98450s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -97460s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 6992	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 4780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7648	Thread sleep count: 945 > 30
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7648	Thread sleep count: 4331 > 30
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99563s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99438s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99313s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99188s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -99063s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98953s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98844s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98719s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98610s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98485s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98360s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98235s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98108s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -98000s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97891s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97781s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97672s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97563s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97438s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97328s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97219s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -97108s >= -30000s
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe TID: 7888	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99545	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98669	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98557	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98438	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98313	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 98063	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97844	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97719	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97499	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97390	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 97143	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98450	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97460	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99563
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99438
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99313
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99188
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 99063
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98953
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98844
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98719
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98610
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98485
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98360
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98235
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98108
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 98000
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97891
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97781
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97672
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97563
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97438
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97328
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97219
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 97108
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Thread delayed: delay time: 922337203685477

Source: z68ORDER.scr.exe, 00000000.00000002.1327850183.00000000086E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe"
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Memory written: C:\Users\user\Desktop\z68ORDER.scr.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory written: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Memory written: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Process created: C:\Users\user\Desktop\z68ORDER.scr.exe "C:\Users\user\Desktop\z68ORDER.scr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Process created: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe "C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Users\user\Desktop\z68ORDER.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Users\user\Desktop\z68ORDER.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\z68ORDER.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 10.2.mpTrle.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.39cbc58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.3990c38.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z68ORDER.scr.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z68ORDER.scr.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 8160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 7380, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\z68ORDER.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\z68ORDER.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 10.2.mpTrle.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.39cbc58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.3990c38.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z68ORDER.scr.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z68ORDER.scr.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 8160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 7380, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 10.2.mpTrle.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.39cbc58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.3990c38.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.39cbc58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z68ORDER.scr.exe.3990c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2546108508.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545303921.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1525325777.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z68ORDER.scr.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z68ORDER.scr.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 8160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mpTrle.exe PID: 7380, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z68ORDER.scr.exe	34%	ReversingLabs	Win32.Trojan.Leonem
z68ORDER.scr.exe	34%	Virustotal		Browse
z68ORDER.scr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	34%	ReversingLabs	Win32.Trojan.Leonem
C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe	34%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
us2.smtp.mailhostbox.com	1%	Virustotal		Browse
api.ipify.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	Avira URL Cloud	safe
https://api.ipify.org/	0%	Avira URL Cloud	safe
https://api.ipify.org	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0A	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	Avira URL Cloud	safe
https://account.dyn.com/	0%	Avira URL Cloud	safe
https://api.ipify.org/t	0%	Avira URL Cloud	safe
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe
https://api.ipify.org	0%	Virustotal		Browse
https://api.ipify.org/	0%	Virustotal		Browse
https://sectigo.com/CPS0	0%	Virustotal		Browse
https://api.ipify.org/t	0%	Virustotal		Browse
http://us2.smtp.mailhostbox.com	1%	Virustotal		Browse
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	Virustotal		Browse
https://account.dyn.com/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	true	1%, Virustotal, Browse	unknown
api.ipify.org	104.26.13.205	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0A	z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1532698130.0000000006732000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	z68ORDER.scr.exe, 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2542470162.0000000000E4D000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1523301310.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2558475079.0000000006070000.00000004.00000020.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2542735415.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	z68ORDER.scr.exe, 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.org/t	z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E89000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	z68ORDER.scr.exe, 00000000.00000002.1320773433.0000000002969000.00000004.00000800.00020000.00000000.sdmp, z68ORDER.scr.exe, 00000007.00000002.2545303921.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 00000009.00000002.1440089925.0000000002EA9000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000A.00000002.1525325777.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000C.00000002.1523574938.000000000287D000.00000004.00000800.00020000.00000000.sdmp, mpTrle.exe, 0000000D.00000002.2546108508.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1507912
Start date and time:	2024-09-09 14:15:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z68ORDER.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/9@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 299 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:16:38	API Interceptor	28x Sleep call for process: z68ORDER.scr.exe modified
08:16:40	API Interceptor	14x Sleep call for process: powershell.exe modified
08:16:51	API Interceptor	55x Sleep call for process: mpTrle.exe modified
14:16:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run mpTrle C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe
14:16:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run mpTrle C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	z17invoice.exe	Get hash	malicious	AgentTesla	Browse
	z47maaaaaaaaaaaaax.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	giehjhgjzJ.hta	Get hash	malicious	Cobalt Strike, MassLogger RAT, Snake Keylogger	Browse
	NGL1Of0ZkJ.hta	Get hash	malicious	Cobalt Strike, AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19673.26192.exe	Get hash	malicious	AgentTesla	Browse
	Edsha_PO.xls	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Exploit.CVE-2017-0199.04.Gen.20726.10183.xlsx	Get hash	malicious	Snake Keylogger	Browse
104.26.13.205	fptlVDDPkS.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	vstdlib_s64.dll.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	vstdlib_s64.dll.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.Evo-gen.28044.10443.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	vstdlib_s64.dll.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	golang-modules.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	Ransom.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ld.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	SecuriteInfo.com.Win32.PWSX-gen.12778.1808.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	EXmRyGiPUc.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	z17invoice.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	love.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	z47maaaaaaaaaaaaax.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	z55enyioma.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	Statement of Account.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	SOA-Al Daleel -Star Electromechanical.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	RFQ for RIyadh City Water Line Diversion.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	New PO pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
api.ipify.org	Booking_261.exe	Get hash	malicious	AgentTesla, Clipboard Hijacker	Browse	104.26.13.205
	New PO#2729217048.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	shipping doc for Invoice No. 61-FK-24.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DBG1435766.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Documenti di spedizione 00028384.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DBG1475766.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://ct-relevant-violet.pages.dev/help/contact/432501590512485	Get hash	malicious	Unknown	Browse	104.26.12.205
	Public Holiday mem_Notice 2024.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://contact-page-helper.bond/contract/61559135234072	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://buaguhidjn28d.vercel.app/	Get hash	malicious	Unknown	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	PO# 81136575.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	SecuriteInfo.com.Win32.CrypterX-gen.29913.30159.exe	Get hash	malicious	FormBook	Browse	103.76.228.3
	SecuriteInfo.com.Win32.PWSX-gen.12778.1808.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	EXmRyGiPUc.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	AN.exe	Get hash	malicious	AgentTesla	Browse	162.251.85.202
	z17invoice.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	PO_GM_list_30082024202003180817418300824.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	love.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	QUOTE-4K892388-A-C422.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	sZlfJ6FDY9.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
CLOUDFLARENETUS	https://navexglobal.navexone.com/content/dotNet/documents/?docid=9960&public=true	Get hash	malicious	Unknown	Browse	162.247.243.29
	rNEWOREDR726738877288882877737.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	z1PO_200040058.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	MV ALIADO-S-REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	104.21.88.99
	ungziped_file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Booking_261.exe	Get hash	malicious	AgentTesla, Clipboard Hijacker	Browse	172.67.74.152
	dekont.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	http://masdd.line.pm/	Get hash	malicious	Unknown	Browse	172.67.170.224

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	tK6E2PJw16.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	rNEWOREDR726738877288882877737.exe	Get hash	malicious	FormBook	Browse	104.26.13.205
	ungziped_file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	Booking_261.exe	Get hash	malicious	AgentTesla, Clipboard Hijacker	Browse	104.26.13.205
	New PO#2729217048.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	ProjectSpecificationRequirement06092024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	shipping doc for Invoice No. 61-FK-24.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	HN0825H3De2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.13.205
	http://om.ciheam.org/om/pdf/a79/00800645.pdf	Get hash	malicious	Unknown	Browse	104.26.13.205
	#U0130#U015eLEM #U00d6ZET#U0130_110602407178699-1034 nolu TICARI -e-Banka_563028621286.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.205

Process:	C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z68ORDER.scr.exe.log

Download File

Process:	C:\Users\user\Desktop\z68ORDER.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.3797706053345555
Encrypted:	false
SSDEEP:	48:fWSU4xympx4RfoUP7gZ9tK8NPZHUx7u1iMugeC/ZPUyus:fLHxv/IwLZ2KRH6Oug8s
MD5:	B1B3D1207A89A4A3D09468D86D9B7EB5
SHA1:	C589E8ABEA7671751DCB907F565BD24BC02D63B6
SHA-256:	BF59D42A981F2AEE59CA10B06AFB3ED9DDCAE5E6BA2437244F1B18BF900DA108
SHA-512:	85A712941C9A993E8FA547A8FD1262370CE646A48FFB5E4CB1FBFA74DEA7B57FD1FB74A09DF1ABC154419026D4667AE25079617D2B3031704D1B87F6D1C9D10B
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhnjtjw2.guz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxjaekof.nwf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfgv3m3h.5oe.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mw2fwdi2.m3a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

Download File

Process:	C:\Users\user\Desktop\z68ORDER.scr.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	665088
Entropy (8bit):	7.840903651570537
Encrypted:	false
SSDEEP:	12288:BSHUDLjHP7ZRvNRwNKIJHp3SaFq4YdoAu3YlRsrKbypq60Ok8c11igY69i72l:JjHP7vMzpiP4YdoOVbypq9OncTW6kE
MD5:	A04E6EE334556CEBD31E9AE152DDBED1
SHA1:	68DBDDADAD1C6C40B8F824EE44726FEA87118FCC
SHA-256:	5C875F9D28EAE5AFCE4AAC472B0825EDEF8CAC3119D2991D3DD08A1FD32BD424
SHA-512:	6734F4D8E7E124B5080B6AA00EDD980021AD76ADE679E4A9B55C30F86A0E5E916947DCB80AB1D4EC41F31B9A9A4F45CCA5C52002BA1A440767A000DFFDC2142E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 34%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9...............0..............9... ...@....@.. ....................................@.................................59..O....@..L....................`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...L....@......................@..@.reloc.......`.......$..............@..B................i9......H.......x^..Lb...............Y..........................................^..}.....(.......(......0..-.........{....o......,...{.....o......{.....o......>..{.....o........0..H.........{....o....o......{....o....o....o....r...p(......,D..{....o....r...po....&.{....o....r!..po....&.{....o....r;..po....&..{....o....o....o....rQ..p(......,D..{....o....rc..po....&.{....o....rq..po....&.{....o....r...po....&..{....o....o....o....r...p(......,D..{....o....r...po....&.{....o....r..

C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\z68ORDER.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.840903651570537
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	z68ORDER.scr.exe
File size:	665'088 bytes
MD5:	a04e6ee334556cebd31e9ae152ddbed1
SHA1:	68dbddadad1c6c40b8f824ee44726fea87118fcc
SHA256:	5c875f9d28eae5afce4aac472b0825edef8cac3119d2991d3dd08a1fd32bd424
SHA512:	6734f4d8e7e124b5080b6aa00edd980021ad76ade679e4a9b55c30f86a0e5e916947dcb80ab1d4ec41f31b9a9a4f45cca5c52002ba1a440767a000dffdc2142e
SSDEEP:	12288:BSHUDLjHP7ZRvNRwNKIJHp3SaFq4YdoAu3YlRsrKbypq60Ok8c11igY69i72l:JjHP7vMzpiP4YdoOVbypq9OncTW6kE
TLSH:	E0E4122E2528EA52D6BA07744A70D3B607B47E5DF520D30A8FDEECF738163A46520793
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9...............0..............9... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4a398a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFF39ACF5 [Wed Sep 9 20:05:09 2105 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa3935	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x64c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa19cc	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa1990	0xa1a00	0ce8e7d3cfa8999cc69180ee3f2e12c0	False	0.9237133241492653	data	7.850671263446786	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x64c	0x800	c8830a9ac83404506d567e631239832a	False	0.33984375	data	3.4934075118761108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	af52b086362df3acea72fefb4d208acc	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa4090	0x3bc	data			0.4110878661087866
RT_MANIFEST	0xa445c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 14:16:41.175216913 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.175252914 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.175312996 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.182682037 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.182718992 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.647231102 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.647319078 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.651725054 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.651746035 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.652044058 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.698199034 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.750840902 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.791402102 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.860845089 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.861016035 CEST	443	49713	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:41.861793041 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:41.873680115 CEST	49713	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:42.466207027 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:42.472604036 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:42.472896099 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.188369989 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.188568115 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.193669081 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.347160101 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.347338915 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.352591991 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.506031990 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.506618023 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.512326956 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.666176081 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.666220903 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.666259050 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.666295052 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.666323900 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.666640043 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.666640043 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.713825941 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.756941080 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.807605982 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.822472095 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.827533960 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.981472969 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:43.984637976 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:43.990089893 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.143506050 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.144742012 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.150721073 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.307658911 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.308562994 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.315433025 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.474113941 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.475414991 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.484107971 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.636239052 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.636517048 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.642755985 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.823168039 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.823407888 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.829786062 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.983468056 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.984117031 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.984189034 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.984240055 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.984240055 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:44.988928080 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.989139080 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.989149094 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:44.989160061 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:45.380031109 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:45.432610035 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:53.278950930 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.278992891 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.279069901 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.282248974 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.282263994 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.741832972 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.741909981 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.743741035 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.743753910 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.744062901 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.792058945 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.803411007 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.851416111 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.909851074 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.909920931 CEST	443	49718	104.26.13.205	192.168.2.11
Sep 9, 2024 14:16:53.909991980 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:53.926599979 CEST	49718	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:16:54.460814953 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:54.465823889 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:54.465971947 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.013942957 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.014123917 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.018999100 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.169301033 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.173127890 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.178339958 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.328422070 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.330039024 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.335105896 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.485625982 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.485654116 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.485666990 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.485685110 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.485719919 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.485768080 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.572938919 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.575407982 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.580271959 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.730762005 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.736776114 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.741880894 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.892775059 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:55.893322945 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:55.898909092 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.051353931 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.051672935 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.056528091 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.211602926 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.211869955 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.216639996 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.370148897 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.384640932 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.389496088 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.562619925 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.562833071 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.567657948 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.719417095 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.720180988 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.720257044 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.720279932 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.720305920 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:16:56.725070953 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.725087881 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.725152016 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:56.725162029 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:57.106868982 CEST	587	49719	208.91.198.143	192.168.2.11
Sep 9, 2024 14:16:57.151355982 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:01.449421883 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:01.449469090 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:01.449526072 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:01.452637911 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:01.452656031 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:01.939183950 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:01.939260960 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:01.943073034 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:01.943084002 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:01.943516970 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:01.995134115 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:02.018538952 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:02.059428930 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:02.134303093 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:02.134401083 CEST	443	49726	104.26.13.205	192.168.2.11
Sep 9, 2024 14:17:02.134449005 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:02.147876978 CEST	49726	443	192.168.2.11	104.26.13.205
Sep 9, 2024 14:17:02.574071884 CEST	49719	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:02.645219088 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:02.650260925 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:02.650343895 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.198122978 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.198565960 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.203434944 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.354017973 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.354640961 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.360094070 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.510963917 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.511408091 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.519680023 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.667300940 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.667354107 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.667418003 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.667433023 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.667454004 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.667681932 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.754806042 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.762774944 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.769156933 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.921667099 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:03.926834106 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:03.932826042 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.085560083 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.085875034 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:04.090820074 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.243761063 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.244039059 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:04.477647066 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.478841066 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:04.479166985 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.634962082 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.636123896 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:04.642313957 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.796116114 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.796457052 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:04.801908016 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.975657940 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:04.976041079 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:04.981059074 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:05.133662939 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:05.134418964 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:05.134468079 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:05.134506941 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:05.134506941 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:17:05.139455080 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:05.139627934 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:05.139637947 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:05.139647007 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:05.528323889 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:17:05.573263884 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:22.480077028 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:22.485508919 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:22.663486958 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:22.664377928 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:22.664697886 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:22.664709091 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:22.664763927 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:22.664777040 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:22.669506073 CEST	587	49715	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:22.669559002 CEST	49715	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:42.667716026 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:42.675080061 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:42.823606968 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:42.824327946 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:42.824372053 CEST	587	49727	208.91.198.143	192.168.2.11
Sep 9, 2024 14:18:42.824446917 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:42.824481964 CEST	49727	587	192.168.2.11	208.91.198.143
Sep 9, 2024 14:18:42.824862957 CEST	49727	587	192.168.2.11	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 14:16:41.150351048 CEST	57873	53	192.168.2.11	1.1.1.1
Sep 9, 2024 14:16:41.158092976 CEST	53	57873	1.1.1.1	192.168.2.11
Sep 9, 2024 14:16:42.453589916 CEST	54606	53	192.168.2.11	1.1.1.1
Sep 9, 2024 14:16:42.465369940 CEST	53	54606	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 9, 2024 14:16:41.150351048 CEST	192.168.2.11	1.1.1.1	0x5f27	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 9, 2024 14:16:42.453589916 CEST	192.168.2.11	1.1.1.1	0xb9ae	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 9, 2024 14:16:41.158092976 CEST	1.1.1.1	192.168.2.11	0x5f27	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 9, 2024 14:16:41.158092976 CEST	1.1.1.1	192.168.2.11	0x5f27	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 9, 2024 14:16:41.158092976 CEST	1.1.1.1	192.168.2.11	0x5f27	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 9, 2024 14:16:42.465369940 CEST	1.1.1.1	192.168.2.11	0xb9ae	No error (0)	us2.smtp.mailhostbox.com	208.91.198.143	A (IP address)	IN (0x0001)	false
Sep 9, 2024 14:16:42.465369940 CEST	1.1.1.1	192.168.2.11	0xb9ae	No error (0)	us2.smtp.mailhostbox.com	208.91.199.225	A (IP address)	IN (0x0001)	false
Sep 9, 2024 14:16:42.465369940 CEST	1.1.1.1	192.168.2.11	0xb9ae	No error (0)	us2.smtp.mailhostbox.com	208.91.199.223	A (IP address)	IN (0x0001)	false
Sep 9, 2024 14:16:42.465369940 CEST	1.1.1.1	192.168.2.11	0xb9ae	No error (0)	us2.smtp.mailhostbox.com	208.91.199.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49713	104.26.13.205	443	7732	C:\Users\user\Desktop\z68ORDER.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-09 12:16:41 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-09 12:16:41 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 12:16:41 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c071c653cc8c481-EWR
2024-09-09 12:16:41 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49718	104.26.13.205	443	8160	C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-09 12:16:53 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-09 12:16:53 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 12:16:53 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c071cb08afc0f8f-EWR
2024-09-09 12:16:53 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49726	104.26.13.205	443	7380	C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-09 12:17:02 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-09 12:17:02 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 12:17:02 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c071ce3eb928ccd-EWR
2024-09-09 12:17:02 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 9, 2024 14:16:43.188369989 CEST	587	49715	208.91.198.143	192.168.2.11	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 9, 2024 14:16:43.188568115 CEST	49715	587	192.168.2.11	208.91.198.143	EHLO 287400
Sep 9, 2024 14:16:43.347160101 CEST	587	49715	208.91.198.143	192.168.2.11	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 9, 2024 14:16:43.347338915 CEST	49715	587	192.168.2.11	208.91.198.143	STARTTLS
Sep 9, 2024 14:16:43.506031990 CEST	587	49715	208.91.198.143	192.168.2.11	220 2.0.0 Ready to start TLS
Sep 9, 2024 14:16:55.013942957 CEST	587	49719	208.91.198.143	192.168.2.11	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 9, 2024 14:16:55.014123917 CEST	49719	587	192.168.2.11	208.91.198.143	EHLO 287400
Sep 9, 2024 14:16:55.169301033 CEST	587	49719	208.91.198.143	192.168.2.11	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 9, 2024 14:16:55.173127890 CEST	49719	587	192.168.2.11	208.91.198.143	STARTTLS
Sep 9, 2024 14:16:55.328422070 CEST	587	49719	208.91.198.143	192.168.2.11	220 2.0.0 Ready to start TLS
Sep 9, 2024 14:17:03.198122978 CEST	587	49727	208.91.198.143	192.168.2.11	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 9, 2024 14:17:03.198565960 CEST	49727	587	192.168.2.11	208.91.198.143	EHLO 287400
Sep 9, 2024 14:17:03.354017973 CEST	587	49727	208.91.198.143	192.168.2.11	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 9, 2024 14:17:03.354640961 CEST	49727	587	192.168.2.11	208.91.198.143	STARTTLS
Sep 9, 2024 14:17:03.510963917 CEST	587	49727	208.91.198.143	192.168.2.11	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	08:16:38
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\z68ORDER.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z68ORDER.scr.exe"
Imagebase:	0x480000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1322262193.0000000003909000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:16:39
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z68ORDER.scr.exe"
Imagebase:	0xd00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:16:39
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:16:39
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\z68ORDER.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\z68ORDER.scr.exe"
Imagebase:	0x360000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:16:39
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\z68ORDER.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\z68ORDER.scr.exe"
Imagebase:	0x3a0000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:16:39
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\z68ORDER.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z68ORDER.scr.exe"
Imagebase:	0x790000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2545303921.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2545303921.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2545303921.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2545303921.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2545303921.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:16:41
Start date:	09/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6220e0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:16:50
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Imagebase:	0xaf0000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs Detection: 34%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:16:51
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Imagebase:	0xa80000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1525325777.0000000002E93000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1521450126.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1525325777.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1525325777.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1525325777.0000000002E89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1525325777.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:16:58
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Imagebase:	0x330000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:16:59
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe"
Imagebase:	0x7b0000
File size:	665'088 bytes
MD5 hash:	A04E6EE334556CEBD31E9AE152DDBED1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2546108508.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2546108508.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2546108508.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2546108508.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2546108508.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	343
Total number of Limit Nodes:	10

Executed Functions

Function 04DB7750 Relevance: 4.5, Strings: 2, Instructions: 2009
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp_q, xrefs: 04DB81BB
sd&, xrefs: 04DB8226, 04DB822B

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID:
String ID: Pp_q$sd&
API String ID: 0-203798260
Opcode ID: ff15a0e43651cfb583c41e20f34b6d4bb3f73e6d8f0333cd73972e9aaa7b589c
Instruction ID: 1ba3287089a0f595e8b3febb1aabf07fc860839bad6da8e849a2760b23937dcb
Opcode Fuzzy Hash: ff15a0e43651cfb583c41e20f34b6d4bb3f73e6d8f0333cd73972e9aaa7b589c
Instruction Fuzzy Hash: C623D434A11259CFDB25EF24C898ADAB7B2FF8A305F1041E9D4096B365DB31AE81CF50

Function 04DB7740 Relevance: 4.4, Strings: 2, Instructions: 1889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp_q, xrefs: 04DB81BB
sd&, xrefs: 04DB8226, 04DB822B

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID:
String ID: Pp_q$sd&
API String ID: 0-203798260
Opcode ID: 528544750e47b88dcd1a6baadc1ee5b7c050b5d5cb7b1b32c99e85fe5d97704f
Instruction ID: fa02a52a79183f5102a30549905196c71e079cf58c78eade435e64a6240e660e
Opcode Fuzzy Hash: 528544750e47b88dcd1a6baadc1ee5b7c050b5d5cb7b1b32c99e85fe5d97704f
Instruction Fuzzy Hash: CB13D334A11259CFDB25EF24C898ADAB7B1FF8A305F1141E9E4096B365DB31AE81CF50

Function 06A88AA8 Relevance: 1.7, Strings: 1, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'_q, xrefs: 06A89048

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 2813c167ae5c6681da8a481179c0112ec0e49661f36ff8ba744d93738f0840d4
Instruction ID: 07c69de9ef1b433263d53245c194592356a5859083f8fdacc64050c1990fe644
Opcode Fuzzy Hash: 2813c167ae5c6681da8a481179c0112ec0e49661f36ff8ba744d93738f0840d4
Instruction Fuzzy Hash: C9F19430A04209DFDB05FFB8C9946AE7BB2FF88304F158499E805AB36ADB359D45CB51

Function 06A87957 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

`6, xrefs: 06A879CB

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID: `6
API String ID: 0-3354348281
Opcode ID: 1ae88cb70ef181154e9a957fc208b0c493c49b9c6f51f4af009ee026d699aab4
Instruction ID: 9ed46c9f6e2a0a3c2be9dc87c40049ae7d5bccd72ff1b78788bebec911e178f6
Opcode Fuzzy Hash: 1ae88cb70ef181154e9a957fc208b0c493c49b9c6f51f4af009ee026d699aab4
Instruction Fuzzy Hash: DEF11874E042598FCB54EFA9C9809AEFBF2FF49304F248169D415AB356D730A941CFA0

Function 06A8E320 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750159e7232875bfd8341e842a9093c8195c231c40d7908003316fceeaff247c
Instruction ID: fa592f0dffc9b17adcb718d825a9ca48d2ee28b0a503522b61c74aa39a82ecea
Opcode Fuzzy Hash: 750159e7232875bfd8341e842a9093c8195c231c40d7908003316fceeaff247c
Instruction Fuzzy Hash: B2E1AA30B01644DFDBA9FB66C950BAEB7FABF89700F144869E1059B291DF35E801CB61

Function 00FED031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FED0BE
GetCurrentThread.KERNEL32 ref: 00FED0FB
GetCurrentProcess.KERNEL32 ref: 00FED138
GetCurrentThreadId.KERNEL32 ref: 00FED191

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 404042f48dbe08106058dcd20b473c8220de855e8afe2a3408d3c7aab94bc08e
Instruction ID: 3f74b95bdf85e9672a6554a0b8e92ebbb9a41c0810701ea696846bbd40507d5c
Opcode Fuzzy Hash: 404042f48dbe08106058dcd20b473c8220de855e8afe2a3408d3c7aab94bc08e
Instruction Fuzzy Hash: CF5165B0D00249DFDB54DFAAD548BAEBBF1EF48314F208469E409A73A1D7756844CF62

Function 00FED040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FED0BE
GetCurrentThread.KERNEL32 ref: 00FED0FB
GetCurrentProcess.KERNEL32 ref: 00FED138
GetCurrentThreadId.KERNEL32 ref: 00FED191

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 25ccfc17f94e10be3b15b11242ab777800085d7f71ff6962daed71a364379f66
Instruction ID: 9f07942d90d2fcf2738128211dfb2966dd3a8af4368d0f84d4d0dd7262ee6abc
Opcode Fuzzy Hash: 25ccfc17f94e10be3b15b11242ab777800085d7f71ff6962daed71a364379f66
Instruction Fuzzy Hash: C55164B0D00249CFDB54DFAAD548BAEBBF1EF48314F208469E409A7361D774A944CF66

Function 06A8AE04 Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06A8B046

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5dedf5c0aebcdf850a71e638638bc4e6aefad539c910ef178cd1eb25b51a23d5
Instruction ID: 6656f960fea3c16a4d97c60594f911cb404077365e573399a5e0f9bf85a216ce
Opcode Fuzzy Hash: 5dedf5c0aebcdf850a71e638638bc4e6aefad539c910ef178cd1eb25b51a23d5
Instruction Fuzzy Hash: C9A17B71D00219DFDB60EF68C841BEEBBB2BF49304F14856AE859A7240DB749985CFA1

Function 06A8AE10 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06A8B046

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: de4c7c858f6805ae00b6ab1ed3a68140d2dd8cc38364db7a1ec4642f4a252aae
Instruction ID: cef58670300790f6830abe3a80513f169f2fd4a3a5b51eeb762d214fde446858
Opcode Fuzzy Hash: de4c7c858f6805ae00b6ab1ed3a68140d2dd8cc38364db7a1ec4642f4a252aae
Instruction Fuzzy Hash: 1A918B71D00219CFDF60EF69C8417EDBBB2BF49304F14856AE819AB240DB749985CFA1

Function 00FEADA8 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00FEAFFE

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f3a323f8fe75a401cfa67cd35c5a5e42425ad72458f3a362e878536b7b055076
Instruction ID: a4eb2b8e5782ba72dd278f98a8531c01b990d1d106fcde0b6085bf0ec8c0513b
Opcode Fuzzy Hash: f3a323f8fe75a401cfa67cd35c5a5e42425ad72458f3a362e878536b7b055076
Instruction Fuzzy Hash: 83814570A00B858FDB24DF2AC44575ABBF1FF88314F10892ED08A97A51D775F849CB92

Function 04DB18E4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04DB1A02

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: feaa469f9d71b0a300c97e6c439a8c947f1b3f7edfe860b75ebb3426263f7cc7
Instruction ID: 5fe7d4a7c0a24f8b0e07852d37505770f7e0216caa767c9224391e436a3c621a
Opcode Fuzzy Hash: feaa469f9d71b0a300c97e6c439a8c947f1b3f7edfe860b75ebb3426263f7cc7
Instruction Fuzzy Hash: 9151C2B1D00359EFDB14CF99C894ADEBFB5BF48350F24822AE859AB210D771A945CF90

Function 04DB18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04DB1A02

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: df62f91282091aacc8badbca32dd24246b538c8b3d01d129e785cf2aa88620db
Instruction ID: 6b8b93138000d8f53129ce4d4dc331ff7c01153722cae97973f2513ed788b5f8
Opcode Fuzzy Hash: df62f91282091aacc8badbca32dd24246b538c8b3d01d129e785cf2aa88620db
Instruction Fuzzy Hash: 8041B0B1D00359EFDB14CF99C894ADEBBB5BF48350F24822AE819AB210D771A945CF90

Function 00FE590C Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00FE59C9

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7dff00a4f6fc9a11922ab2f4b890bd00a2ed918cd174dcfacc5a5523ebaa0ed1
Instruction ID: a43b4dfd283183cc74a02dc280bbf0d42e5ad078ed2dc6e4209f8da0779d4dab
Opcode Fuzzy Hash: 7dff00a4f6fc9a11922ab2f4b890bd00a2ed918cd174dcfacc5a5523ebaa0ed1
Instruction Fuzzy Hash: 734134B0C00619CBDB24CFAAC8847DEBBB5BF48708F20806AD409AB255DB745945CF90

Function 00FE44C4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00FE59C9

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a055cf439ad6445b4c11ce417c46643170e4d5fea9a1da18eb66e45e17c1f412
Instruction ID: 92044cc375e34896f9308f05f3e813e0b7305f2c363a6886e326e62b2816b695
Opcode Fuzzy Hash: a055cf439ad6445b4c11ce417c46643170e4d5fea9a1da18eb66e45e17c1f412
Instruction Fuzzy Hash: 804113B1C0075DCBDB24DFAAC884B8EBBF5BF48708F20806AD409AB255DB755945CF90

Function 04DB4040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04DB4101

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 79962163860a82328326e7a4af56487be70aa0235745a61d0a93d8c75f09dd06
Instruction ID: 59ebb695eb2e4d7128c4479ebdc5d275a0ff2118cddfb0ef1cc6dbcc8eed9b8e
Opcode Fuzzy Hash: 79962163860a82328326e7a4af56487be70aa0235745a61d0a93d8c75f09dd06
Instruction Fuzzy Hash: 624138B4A00309DFCB14CF99C848AAABBF5FF88314F25C459D559AB322D374A841CFA0

Function 06A8A951 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06A8A8F8

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e8d3f33190185237ccaba1c9f643b72bfc799f6f8ae39780f999fc0e07a1a091
Instruction ID: dbedd1860645f2392ff47755cc933786630c372701eca39eb46ff523237b95d2
Opcode Fuzzy Hash: e8d3f33190185237ccaba1c9f643b72bfc799f6f8ae39780f999fc0e07a1a091
Instruction Fuzzy Hash: F2319872D043088EDB20EFA9C9057DEFFF1AF88320F21881AC559A7250C779A545CBA0

Function 06A8D7A3 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a52857ffdbcda1e1650a5cafd1d96493890c7ecad657b73466cb118f1018345
Instruction ID: 4ceefc68096f7da89fe4bd289996de629a984ef8126275ca82dff010b669ac4a
Opcode Fuzzy Hash: 9a52857ffdbcda1e1650a5cafd1d96493890c7ecad657b73466cb118f1018345
Instruction Fuzzy Hash: 8821ED75D042189FDB20FF99D8047EEBBF4AF48700F20401AD544BB280CB755940CBE1

Function 06A8A780 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06A8A818

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a2e03ea964854cd0fe1766a8ac839f894d0a44f5833241a3991acd8e5f8e9658
Instruction ID: a40b6d855570d101fe4961a5a281c260c0a64ab58a01b34ed402de647c5c0770
Opcode Fuzzy Hash: a2e03ea964854cd0fe1766a8ac839f894d0a44f5833241a3991acd8e5f8e9658
Instruction Fuzzy Hash: 4B214675D003499FCB10DFA9C885BDEBBF5FF48310F10842AE919A7240D778A955CBA0

Function 06A8A788 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06A8A818

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8551bf952b3437b809458151c797991931035b6bfacef37a126319bc8ea10b9c
Instruction ID: c503c2271b3d20a5c92b478a758b7d13b4a5adc9d96d30d77764e1cfbddf2705
Opcode Fuzzy Hash: 8551bf952b3437b809458151c797991931035b6bfacef37a126319bc8ea10b9c
Instruction Fuzzy Hash: 562136B5D003599FCB10DFA9C985BEEBBF5FF48310F10842AE919A7240D778A955CBA0

Function 06A8A870 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06A8A8F8

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8295c9b8495543920a4dcbfe423fb5d2320e3feeb652e5f4866c5eecd46ec958
Instruction ID: 08f60379fe94b5e7e4d5448ef24e51805a2a0429dc98ea5f4ac5b57beaab2eb7
Opcode Fuzzy Hash: 8295c9b8495543920a4dcbfe423fb5d2320e3feeb652e5f4866c5eecd46ec958
Instruction Fuzzy Hash: 5C2136B1D002499FDB10DFAAC881AEEFBF5FF48310F10842AE519A7240C7359945CBA0

Function 06A8A5E9 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06A8A66E

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fec306896e1727a675be83eeeb8223d4621f0cd6feb730cc31167cefc439967d
Instruction ID: 4d65dca9b7ec1d13e847b2bdb89b6adc9cde7ce86b6155e3ddca59411928af5b
Opcode Fuzzy Hash: fec306896e1727a675be83eeeb8223d4621f0cd6feb730cc31167cefc439967d
Instruction Fuzzy Hash: 62215771D002099FCB50EFAAC4857EEFBF4EF48324F14842AD519A7240DB78A945CFA0

Function 00FED689 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FED717

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bdac14dcecc0a1b7c7df595d024f78a7f84d7a6a1f805ca0553efba9157fc016
Instruction ID: ef8e38fdf0684acd9012811dca16686f59eecdc1c17c06b52bdcd1b96b1d1940
Opcode Fuzzy Hash: bdac14dcecc0a1b7c7df595d024f78a7f84d7a6a1f805ca0553efba9157fc016
Instruction Fuzzy Hash: 9321E4B5D00248AFDB10CFAAD585ADEBFF8EB48324F14841AE918B3310D374A954CFA0

Function 06A8A5F0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06A8A66E

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f939226342762e5d58bad2bc4e983a9c95251d39c23d00d7a8aa78f68f27a4a1
Instruction ID: 06dd8276cadf274b1a12028e56f5970912cc413075aff5ed40aed8ccd5a5cf79
Opcode Fuzzy Hash: f939226342762e5d58bad2bc4e983a9c95251d39c23d00d7a8aa78f68f27a4a1
Instruction Fuzzy Hash: EA214771D003098FDB50EFAAC4857EEBBF4EF48324F14842AD519A7240D778A945CFA0

Function 06A8A878 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06A8A8F8

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4b866bd605bab82e325ff3a7377a2d7bcce5b60dee10b51470736e1c4e9a7bda
Instruction ID: 68c691e62a548673182fa23ee4aeb9f6fe72045aa3ea2685e7601521ce049ba3
Opcode Fuzzy Hash: 4b866bd605bab82e325ff3a7377a2d7bcce5b60dee10b51470736e1c4e9a7bda
Instruction Fuzzy Hash: C52139B1D003599FCB10DFAAC881ADEFBF5FF48310F10842AE519A7240D7759945CBA0

Function 00FED690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FED717

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b25976d9e34434dc7d177e8339ffc10c9ea346a5b844ab780627fc0f80a7dd3b
Instruction ID: ce18853c2b93228f028da1017f15656237ce74596cdb6416bbc20f97d1181fe5
Opcode Fuzzy Hash: b25976d9e34434dc7d177e8339ffc10c9ea346a5b844ab780627fc0f80a7dd3b
Instruction Fuzzy Hash: 2221C4B5D00248AFDB10CFAAD585ADEBFF8EB48310F14841AE918A3350D374A954CFA5

Function 06A8A6C1 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06A8A736

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 90b54e9c0a1216bee7e9b47845869ee4419edeba356be215c35491cb7ca23d00
Instruction ID: 0eeecab8d6144589408ced25ef8f935db1ee98a58a0e222f6964824d339a6a5d
Opcode Fuzzy Hash: 90b54e9c0a1216bee7e9b47845869ee4419edeba356be215c35491cb7ca23d00
Instruction Fuzzy Hash: 3C1159719002099FCB14EFA9C845ADEFFF5EF48320F10841AE519A7250C775A554DFA0

Function 06A8A6C8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06A8A736

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f49bba2a500a01951765fdb663260dbfd8a813bccf214eb566d0b0ea690f7034
Instruction ID: 5aca77a34d143b1f9c9a422613caa802866b9f4556a0dfe98302be886afacf85
Opcode Fuzzy Hash: f49bba2a500a01951765fdb663260dbfd8a813bccf214eb566d0b0ea690f7034
Instruction Fuzzy Hash: 9F1137719002499FCB10EFAAC845BDEBFF5EF48320F10841AE519A7250C775A944CFA0

Function 06A8A100 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06A8A16A

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0ccb1b69997f9b01e031a00a6e1d345997c854f918205d9730d1e2fc64f58214
Instruction ID: 8044a0a1594b98f143d0ad95b3fcdd86028c8a666636af2c725cf4fb2198b70f
Opcode Fuzzy Hash: 0ccb1b69997f9b01e031a00a6e1d345997c854f918205d9730d1e2fc64f58214
Instruction Fuzzy Hash: 95115B71D002098FCB24DFAAC8457DEFFF4EB49314F24841AD519A7240C7756544CBA4

Function 06A8A108 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06A8A16A

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1bbcbc9797ff7c5efe1ba2460ffcd2438f57dd95a79e8f49d91546f0a17b7e82
Instruction ID: 4beebb3943dbd585f7b3f97189e419bc9733f4cbd53b820c8e7acc6540d699cd
Opcode Fuzzy Hash: 1bbcbc9797ff7c5efe1ba2460ffcd2438f57dd95a79e8f49d91546f0a17b7e82
Instruction Fuzzy Hash: DF1136B1D002488FCB24EFAAC8457DEFBF4EB88324F20841AD519A7240C779A945CBA4

Function 06A8AAF4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06A8D76D

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a288e2c1288d6266f634534f2f0e42dd8780e1df843c54cce4e4b9d629cd95a4
Instruction ID: 7e4b7dfb1bf0e4df903ac756801c5b0e3a773cbacf51dba1929d67d929f6934f
Opcode Fuzzy Hash: a288e2c1288d6266f634534f2f0e42dd8780e1df843c54cce4e4b9d629cd95a4
Instruction Fuzzy Hash: B21103B58003489FDB50EF9AD889BDEFBF8EB48310F208419E958B7240D375A954CFA5

Function 00FEAF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00FEAFFE

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 794db74a8f9edcbf45808a8a77b873e85c12660d7799a5062f1a6512f261be89
Instruction ID: 3b063b7ca1b434c21d43141e7e0490af3f23ac53714f368795a0d994a0fefd4a
Opcode Fuzzy Hash: 794db74a8f9edcbf45808a8a77b873e85c12660d7799a5062f1a6512f261be89
Instruction Fuzzy Hash: AE11DFB5C006498FCB14DF9AD444B9EFBF5AB88324F11841AD929A7210D375A545CFA1

Function 06A8D708 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06A8D76D

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 89efd79ba3016b27d895324122f57d914b7bc522ab7c2d9676daf1047d3ab632
Instruction ID: 45d855a2df6f67f1659b881f3e3c8c41283975dc5982139ec2b82f4e88fe12b9
Opcode Fuzzy Hash: 89efd79ba3016b27d895324122f57d914b7bc522ab7c2d9676daf1047d3ab632
Instruction Fuzzy Hash: D81103B58003499FDB50EF9AD985BDEBBF4EB48310F20841AD918B7640C374A554CFA1

Function 00BED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319470158.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f5ba81c01ccbb8e73d834ae02a3c03732ce2e2004477a13cd1dfa23f4d371
Instruction ID: 99dd27d0084b0040598cbc793ffe45f9d606543626dc2c4a633afbaa844401b2
Opcode Fuzzy Hash: 683f5ba81c01ccbb8e73d834ae02a3c03732ce2e2004477a13cd1dfa23f4d371
Instruction Fuzzy Hash: A2214871100284DFCB01DF05C9C0B16BFB5FBA8314F20C1A8E8090B39AC376E806C6A2

Function 00BED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319470158.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6f75e9cf426b4047065a595622f1cf958b30880966b0f9bcf7b6cd8010779f
Instruction ID: 930324dcbd6acab7218755f6d8d9e3e751779306dc3dc9ce92b959ae3aca5657
Opcode Fuzzy Hash: fa6f75e9cf426b4047065a595622f1cf958b30880966b0f9bcf7b6cd8010779f
Instruction Fuzzy Hash: 43213771504280DFDB05DF15D9C0F26BFE5FBA8318F20C5A9E8090B256C376D816CBA1

Function 00BFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319606795.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22415c227daef370eeada99d210e33eddad9316065bf7192553d425d101136c0
Instruction ID: 3cd667998fd705f455cb7bbc7971f315df9b0ee171ee8f123b84a4dade83f1b9
Opcode Fuzzy Hash: 22415c227daef370eeada99d210e33eddad9316065bf7192553d425d101136c0
Instruction Fuzzy Hash: EE210775504208DFDB14DF24D5D4B26BFA6FB84314F20C5ADEA094B356CB36D80BCA61

Function 00BFD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319606795.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954f879bfdc1fcfd3feeff955caa8989b0b8c23d024812fdd07e320360c54d59
Instruction ID: d49b7aa4237a4bf45d07dfc21f12f0d37b461393e3ac9b44fcaf34bdeba568f4
Opcode Fuzzy Hash: 954f879bfdc1fcfd3feeff955caa8989b0b8c23d024812fdd07e320360c54d59
Instruction Fuzzy Hash: 48212971604208DFDB05DF14D5C0B36BBE6FB84314F20C5EDEA094B255C376D80ACAA1

Function 00BFD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319606795.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc455448f44cc6c9da7928c7570761a28dfadf4735e1642a9413c969293c4cc2
Instruction ID: ed080001a3edc55d57786b996d694b02f498c9c698c4bc261bc930959a7c0fee
Opcode Fuzzy Hash: dc455448f44cc6c9da7928c7570761a28dfadf4735e1642a9413c969293c4cc2
Instruction Fuzzy Hash: 7721C6755093848FCB06CF20D594715BFB2EB45314F28C5EAD9498B297C33AD80ACB62

Function 00BED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319470158.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction ID: ffbc094988ac5a82dab0421870e7d68a95c71f358ae1e7788984948a25c251a2
Opcode Fuzzy Hash: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction Fuzzy Hash: AC11D376504280CFCB16CF14D9C4B16BFB1FBA4314F24C6AAD8490B656C336D85ACBA1

Function 00BED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319470158.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction ID: 24d3b15d834695a1abaa08dda2effe9c173fa39026fd20e0ffea81e50fb08809
Opcode Fuzzy Hash: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction Fuzzy Hash: 04110376504280CFCB02CF00D5C4B16BFB1FBA4324F24C2A9E8090B356C33AE85ACBA1

Function 00BFD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319606795.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: e7c8acf254dc3108d77851e1b2f2327f5a8ea3f7da64cab980fe29b4c0b14e96
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 0611DD75504284DFCB02CF10C5C4B25FBB2FB84314F24C6AED9494B296C33AD80ACBA1

Non-executed Functions

Function 06A87970 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

`6, xrefs: 06A879CB

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID: `6
API String ID: 0-3354348281
Opcode ID: 8accfc7463159c237350263ce18b06f9847da66d775d80ebea2a5343b63065d7
Instruction ID: 3481aeb0653f36b244db971508151951a74e20e99767c50d27cdea0ba308429b
Opcode Fuzzy Hash: 8accfc7463159c237350263ce18b06f9847da66d775d80ebea2a5343b63065d7
Instruction Fuzzy Hash: DC510C74E112198FDB14DFA9C5805AEFBF2BF89304F24C16AD418AB315D730AA42CFA1

Function 06A87D98 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646de908c7a0ef8f3a4f0c30799d75b08d70c952ece7941efc7d7bdeab42d846
Instruction ID: bc365e53547ae3d85c894ec89d92961874d037ff9fd1c98417521cbf8e055fe0
Opcode Fuzzy Hash: 646de908c7a0ef8f3a4f0c30799d75b08d70c952ece7941efc7d7bdeab42d846
Instruction Fuzzy Hash: 9EE11974E051598FCB14EFA9C5809AEFBF2BF89304F248169D414AB355DB34AD82CFA0

Function 04DB0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89bcf5561b30d48e1907ba14a65924cf88284344c5fddce3af985859c9d1170
Instruction ID: 4d8e9369b466b961f66d97c82f7446f7dc3b2d8156791f0196405f930bcf3d3e
Opcode Fuzzy Hash: e89bcf5561b30d48e1907ba14a65924cf88284344c5fddce3af985859c9d1170
Instruction Fuzzy Hash: 5612C7B0D827468AD352DF26E88CB893BB2BB44319FD0CB09D2615F2E1D7B4116ACF44

Function 06A8A1B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3b1db3d735cb793dcaed075373a653be159cc3fdcd897d476adc38307b700d
Instruction ID: c0d50f5f26c0a512a2c8dc41065d62befff8acc49f8e3112cef3e8689b598ac7
Opcode Fuzzy Hash: 7c3b1db3d735cb793dcaed075373a653be159cc3fdcd897d476adc38307b700d
Instruction Fuzzy Hash: 74E10974E012598FCB14EFA9C5809AEFBB2FF89304F24816AD515AB355D734AD81CFA0

Function 06A881E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4ed3f346b932cd3c2664b7c920040a3049212dd5402659e67bedc658751020
Instruction ID: 7f48095b92c6d406658012ae5a6c51eb039f5c9f7fccdc7f84d4bda3662dff5e
Opcode Fuzzy Hash: 3c4ed3f346b932cd3c2664b7c920040a3049212dd5402659e67bedc658751020
Instruction Fuzzy Hash: EFE1F8B4E052598FCB14EFA9C5809AEFBB2FF89304F248169D415AB355DB34AD41CFA0

Function 06A89888 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e83c1e917b51efef8e7f7bbf66e98a1c30f962907a3a7de17c66018ff4ff6e
Instruction ID: 5c7ef53668b27092ab7fbefe26d476ea616bdf2d94d39dd2625087c9f91a1bd2
Opcode Fuzzy Hash: 27e83c1e917b51efef8e7f7bbf66e98a1c30f962907a3a7de17c66018ff4ff6e
Instruction Fuzzy Hash: 28E109B4E141598FCB14EFA9C5809AEFBF2FF89304F248169D415AB356D731A942CFA0

Function 00FED5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1319967436.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5795fcb657098d1988c85c10e29a9276deab777e3be10e4c64ae090a79d0152
Instruction ID: b8ac7b948983bc7a250dbf58b1b424cf284d2a87d1c21cf48b328a2c82b92122
Opcode Fuzzy Hash: d5795fcb657098d1988c85c10e29a9276deab777e3be10e4c64ae090a79d0152
Instruction Fuzzy Hash: A8A17F32E00249CFCF09DFB6C84499EB7B2FF85310B25857AE805AB265DB35E959DB40

Function 04DB0007 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce15b449f5573451e2c94bcd84f624a77687713cf48571ef376144e6758e305a
Instruction ID: 57c16d8dc9219f48dba3d975a6e6e488ad662c51b21927d46871bff69ca317db
Opcode Fuzzy Hash: ce15b449f5573451e2c94bcd84f624a77687713cf48571ef376144e6758e305a
Instruction Fuzzy Hash: 59C12CB0D817468FD712DF66E888A893BB1BB85319F90CB09D1616F2E1DBB4146ACF44

Function 06A881D1 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba24f2c3bb00425de550b7037fdcf1fac0d72261f28d40c6cfe7267702ba5844
Instruction ID: cdb921dbf61e766ddc1aa9a5046118f31ab11f61fc68fbe839a5e9829e8aa75e
Opcode Fuzzy Hash: ba24f2c3bb00425de550b7037fdcf1fac0d72261f28d40c6cfe7267702ba5844
Instruction Fuzzy Hash: 36510D70E152198FDB14DFAAC5805AEFBF2FF89304F248169D418AB215DB34A942CFA0

Function 06A87DA8 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1326449579.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4961aa9a77b510e7e4c7c43137ff8809e262f8f1786413d93b00523fa3688c
Instruction ID: 2bfff1323a1834ff04163006fb1ec8d874bbfb48cc64b4281506a337badc7fc7
Opcode Fuzzy Hash: 0c4961aa9a77b510e7e4c7c43137ff8809e262f8f1786413d93b00523fa3688c
Instruction Fuzzy Hash: D251C874E152198FDB14DFAAC9805AEFBF2BF89304F24C169D418AB315D731A942CFA1

Function 04DBBC43 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324198058.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067876b4a4a1e41b502bf401ff515b44ccc91ad2f3197a2065d841857436e635
Instruction ID: 85aae663d969d60125b979bc8643731b2421a29bce6d14e8ff5b231d1f021d64
Opcode Fuzzy Hash: 067876b4a4a1e41b502bf401ff515b44ccc91ad2f3197a2065d841857436e635
Instruction Fuzzy Hash: 76319631850E19CBDF1E4FB684925CDBB70FF27718FA4474CC965A21DAEA6540A3C681

Analysis Process: z68ORDER.scr.exePID: 7732, Parent PID: 7492COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	147
Total number of Limit Nodes:	11

Executed Functions

Function 06822780 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON

Download Yara Rule

Strings

$_q, xrefs: 06823BB0
$_q, xrefs: 06823BE0
$_q, xrefs: 06823B87
$_q, xrefs: 06823BD4
$_q, xrefs: 06823BBC
$_q, xrefs: 06823B93

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: ee72610afcc536a6696f778ad9164c5ef0349810a627e3d8b89056d4b5f681b7
Instruction ID: c2b5c372f771edb3843e22895f50fbc7e98158e80c906ae9acb5ed06b992e27b
Opcode Fuzzy Hash: ee72610afcc536a6696f778ad9164c5ef0349810a627e3d8b89056d4b5f681b7
Instruction Fuzzy Hash: 70D26B34E0061ACFCB64DB68C594A9DB7B2FF89314F54C5A9D509EB264EB34ED81CB80

Function 06827D68 Relevance: 3.0, Strings: 2, Instructions: 480
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 06828303
$_q, xrefs: 0682830F

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: bc5905f2644f18aa6c04eac9b1e73412b238ee93fb4fe5416f0015254482890f
Instruction ID: 12275fa682d0f85ed523d93f8a63805eb9a28a1655056930e3f28f13eca3515b
Opcode Fuzzy Hash: bc5905f2644f18aa6c04eac9b1e73412b238ee93fb4fe5416f0015254482890f
Instruction Fuzzy Hash: 0302BD70B002268FDF54DB65D994AAEB7E2FF88314F108929D505EB394DB35EC86CB90

Function 06825CE8 Relevance: 2.9, Strings: 2, Instructions: 416
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPdq, xrefs: 06825E1D
\Odq, xrefs: 06825E4D

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: XPdq$\Odq
API String ID: 0-770551486
Opcode ID: e9cc6ff3f1ecf9593d4cd84da921b7e4f46d4d6163720422b729d1a49f6ed81d
Instruction ID: eeeb22d8da4548d618b0ad89f5050bf62a05474752e6b608a11866ad7025ac82
Opcode Fuzzy Hash: e9cc6ff3f1ecf9593d4cd84da921b7e4f46d4d6163720422b729d1a49f6ed81d
Instruction Fuzzy Hash: B9D11631F101268FDB64DB68C484A6EBBF2FF89710F20846AE506DB391DA75DC85C792

Function 068265E0 Relevance: .8, Instructions: 820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c456410c86649a9c735f0615d92a555e960eed445366b67ebdc6d1351e36f8a1
Instruction ID: 97df89b9e7045eec7f5ea013451da82e59c3dd0243c062086c3fa59891784adc
Opcode Fuzzy Hash: c456410c86649a9c735f0615d92a555e960eed445366b67ebdc6d1351e36f8a1
Instruction Fuzzy Hash: A762B034A002269FDB54DB68D594BADB7F2FF88314F108469E505EB394EB35EC86CB90

Function 0682C568 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507be8150f77bfef14ba664ce8a85e84c7ef8ce909d2bbc271ea4e73f83ab9b5
Instruction ID: 21b0eed8155fb99b1490bfbebb85cbd093fd3794dfaa3b58b9746dc3b3dd0418
Opcode Fuzzy Hash: 507be8150f77bfef14ba664ce8a85e84c7ef8ce909d2bbc271ea4e73f83ab9b5
Instruction Fuzzy Hash: 1932C234B1021A9FDF94DB68D590BADBBB2FB88314F108529E505EB354DB35EC82CB91

Function 068255C8 Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297d4890c7641d65f081434d02dceba404fdde4882b06af549cc93c3624a223e
Instruction ID: 1b0b4c980c0f0b1f16be3b6e7299a99b32f30ee6ada533f266dd8438ed91b65e
Opcode Fuzzy Hash: 297d4890c7641d65f081434d02dceba404fdde4882b06af549cc93c3624a223e
Instruction Fuzzy Hash: 84121571F502269FDB24CB64C88066EB7B2FF84314F248429DA56DB384DB34DC82CB92

Function 0682B220 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ec687f96a9a6b00ca6e4c659822171fae1f69aa88262ec18b97258b03026ee
Instruction ID: 8aef31b81b73230f1c13ec74ecc47a3b2d234b30d4ee2b23528351131a723f8f
Opcode Fuzzy Hash: 07ec687f96a9a6b00ca6e4c659822171fae1f69aa88262ec18b97258b03026ee
Instruction Fuzzy Hash: BE228E30E1122A8FDF64CB68C5907ADB7B2FB49318F248826E519EB395DA34DCC5CB51

Function 0682ACB8 Relevance: 10.4, Strings: 8, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0682AE90
$_q, xrefs: 0682AE5B
$_q, xrefs: 0682ADD9
$_q, xrefs: 0682AE38
$_q, xrefs: 0682AE84
$_q, xrefs: 0682AE67
$_q, xrefs: 0682ADE5
$_q, xrefs: 0682AE2C

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: 16cd17f7d505edeb56b8da6fd3ec842c1e0833bd1d58844cc76dcd8ad24f65ba
Instruction ID: 6a59d0304d39d72ff79b40259dc3de8f681dd98cc5384d37212d22d56f18e5e6
Opcode Fuzzy Hash: 16cd17f7d505edeb56b8da6fd3ec842c1e0833bd1d58844cc76dcd8ad24f65ba
Instruction Fuzzy Hash: 68E17134E1021A8FDB69DF68D9906AEB7B2FF84308F108529E505EB354DB74DC86CB91

Function 067C3A0B Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 067C3A96
GetCurrentThread.KERNEL32 ref: 067C3AD3
GetCurrentProcess.KERNEL32 ref: 067C3B10
GetCurrentThreadId.KERNEL32 ref: 067C3B69

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7e833d2c6cd71fadefd7dda60f7b9cbb0b9b1b1ec5db515349cc6e3883e32e78
Instruction ID: ada2e713bb4953bc924d5c0da5149099b28b297a7527c5712598239e6d4108f4
Opcode Fuzzy Hash: 7e833d2c6cd71fadefd7dda60f7b9cbb0b9b1b1ec5db515349cc6e3883e32e78
Instruction Fuzzy Hash: 2C5175B09013098FDB94CFA9D948BAEBBF1BF88324F20C46DE019A7260D7345944CB66

Function 067C3A18 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 067C3A96
GetCurrentThread.KERNEL32 ref: 067C3AD3
GetCurrentProcess.KERNEL32 ref: 067C3B10
GetCurrentThreadId.KERNEL32 ref: 067C3B69

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 93877c278d3e6deabd301419c6784d98962f075ace47d78eab9793996d3aad90
Instruction ID: b05dd75c2faf126005b14d84752a50a163b1288d6cc2488e098f49ee56b99e46
Opcode Fuzzy Hash: 93877c278d3e6deabd301419c6784d98962f075ace47d78eab9793996d3aad90
Instruction Fuzzy Hash: 4F5156B09007099FDB94DFA9D948BAEBBF1FF88324F20C46DE019A7250D7345944CB66

Function 06829140 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 06829193
$_q, xrefs: 06829187
$_q, xrefs: 068291C2
$_q, xrefs: 068291CE

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 527b42de2f2b6b03f577d9b2ba7c6431f1a5eb66e3833d8cb5c3dc9a9bb1cc38
Instruction ID: 573900db27d4b2c75d456c269c604106fb1ebe7343ae1bd8faa2187379a3859e
Opcode Fuzzy Hash: 527b42de2f2b6b03f577d9b2ba7c6431f1a5eb66e3833d8cb5c3dc9a9bb1cc38
Instruction Fuzzy Hash: B9914E70F4021A9FDB54DF65D950BAEB3F6BB88204F108469D909EB348EF709D86CB91

Function 0682D328 Relevance: 4.6, Strings: 3, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0682D727
$_q, xrefs: 0682D733
$_q, xrefs: 0682D71F

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q
API String ID: 0-2441406858
Opcode ID: 63736c63dfe36cb13cbe1ddb7e0ab95fa8134b36d3b038a0eae85dc2a85000a3
Instruction ID: 49d752a42759054525834017de506ee0813acaddf9ec74ec152d2d0c17dcf806
Opcode Fuzzy Hash: 63736c63dfe36cb13cbe1ddb7e0ab95fa8134b36d3b038a0eae85dc2a85000a3
Instruction Fuzzy Hash: 79624130A007169FCB55EF68D690A5DB7B2FF84308B208A68D015DF769EB75EC46CB84

Function 06824B90 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPdq, xrefs: 06824CBD
fdq, xrefs: 0682529D
\Odq, xrefs: 06824D47

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: fdq$XPdq$\Odq
API String ID: 0-727959394
Opcode ID: 23f0d629d5ac855519dad237ca03625cbe9d3913baffbb391f093abae53b2168
Instruction ID: ba8455fe475214bb7197f67ffbb88cc106e8ff567f84e39a46cd71373e2eb18b
Opcode Fuzzy Hash: 23f0d629d5ac855519dad237ca03625cbe9d3913baffbb391f093abae53b2168
Instruction Fuzzy Hash: 24618F70F002299FEB549BA5C8147AEBAF2FF88700F208429D505EB395DF744C458BA1

Function 06829130 Relevance: 2.7, Strings: 2, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 06829187
$_q, xrefs: 068291C2

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: ee99b8074042499bff277562658956785ef72996dd6fb374b66d72829cfebea8
Instruction ID: 7b3a9f2feea0fe720698b1503042feff9d68b1d52898b19cd4abf44fb637fe73
Opcode Fuzzy Hash: ee99b8074042499bff277562658956785ef72996dd6fb374b66d72829cfebea8
Instruction Fuzzy Hash: 46515F70F001169FDF54DB75E950BAE73F6AB88654F108469C909EB398EE34DC82CBA1

Function 067CBE38 Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 067CC09E

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cc284e883cd274305ff3730c652a40c3228eb4f226046bb7ee2744cc073afd4f
Instruction ID: 4178c3091fc2fb3340e8c2fcd5e21b0596c733aec1b3e9f6abc636e98da23cf5
Opcode Fuzzy Hash: cc284e883cd274305ff3730c652a40c3228eb4f226046bb7ee2744cc073afd4f
Instruction Fuzzy Hash: DA815570A00B058FD7A4DF29C44576ABBF1FF88714F00892EE59A9BA50E735E949CF90

Function 011CF580 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2544508517.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11c0000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db91bf3a91c385670050001e9fd6845ca87b2819bebd09a629ce238301eb250d
Instruction ID: fdad2c5d6c857468db17df08eee888b2703bf47694c96f83728617a624d85308
Opcode Fuzzy Hash: db91bf3a91c385670050001e9fd6845ca87b2819bebd09a629ce238301eb250d
Instruction Fuzzy Hash: 10413672D043568FCB08DF79D4042AEBFB5AF99310F15856AD504A7291DB349C46CBE1

Function 067CE424 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067CE542

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8e48c14947a1007a1189236677a1a505d6ff4dc01be7c12de38f94b936ae861a
Instruction ID: 913ce9bdf2119dc2d01c81710234a5417e9adb6cbd73be4c0390ced2f15ac20d
Opcode Fuzzy Hash: 8e48c14947a1007a1189236677a1a505d6ff4dc01be7c12de38f94b936ae861a
Instruction Fuzzy Hash: 0F51C0B1D00309EFDB14CF99D884ADEBBB5BF48314F24812EE819AB250D7749985CF91

Function 067CE430 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067CE542

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c46da4d98407dd1e2e99f7bddf5ca12f0cd258fbcecc9def97379c59349942ed
Instruction ID: b3c2038f50fae35fadde969f2d868b5b5d0c00d210b0bc2cd4f94923f65671d6
Opcode Fuzzy Hash: c46da4d98407dd1e2e99f7bddf5ca12f0cd258fbcecc9def97379c59349942ed
Instruction Fuzzy Hash: 6241C0B1D003099FDB14CF99D884ADEBBB5BF48314F24812EE819AB210D771A985CF91

Function 067C3C58 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067C3CE7

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6b509da7f379d06bbbc1cdb95b0ab42a22374ff8cd23c32706cf57d280da49e7
Instruction ID: b6643ab89c60b74ee3acad3179dd0f76ec08ddad9d0776681631628f14d14dc1
Opcode Fuzzy Hash: 6b509da7f379d06bbbc1cdb95b0ab42a22374ff8cd23c32706cf57d280da49e7
Instruction Fuzzy Hash: 6B2105B5D002189FDB50CF99D985AEEBBF8FB48320F14811AE918A3350C374A940CFA1

Function 011C7838 Relevance: 1.6, APIs: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 011C8700

Memory Dump Source

Source File: 00000007.00000002.2544508517.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11c0000_z68ORDER.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: ebd1cdbba47afc67d109b0137548e01e3de88d957db01dafeff6e0d353932ad2
Instruction ID: 4b47d6145cc522c02deec8a527681468417954916f7131153b9bc5fdf00f669f
Opcode Fuzzy Hash: ebd1cdbba47afc67d109b0137548e01e3de88d957db01dafeff6e0d353932ad2
Instruction Fuzzy Hash: 362123B6C012189FCB54CF99D884ADEFBF5FB88710F10805AE918BB304D375A944CBA5

Function 011C8668 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 011C8700

Memory Dump Source

Source File: 00000007.00000002.2544508517.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11c0000_z68ORDER.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 5504a3c7ddd7febda91d9cdf00fa10f8bd5caf2f939c377df18300747edc45d9
Instruction ID: 8f3a89d2a5c4df03d47ec467857febacdc8b7894992f75b08f813ffa8b0a7b29
Opcode Fuzzy Hash: 5504a3c7ddd7febda91d9cdf00fa10f8bd5caf2f939c377df18300747edc45d9
Instruction Fuzzy Hash: 412125B6C012189FCB14CF99D884ADEFFF5FB88710F25805AE918BB205D375A944CBA0

Function 067C3C60 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067C3CE7

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ef36f2a083b26d7bbc03b38d234ef6a8e2687a636b155a53640b28fd1a70aa28
Instruction ID: 4852b3482eb64f9cda1dddf515e7380e8ef2807b39015c64b68f524ff3978745
Opcode Fuzzy Hash: ef36f2a083b26d7bbc03b38d234ef6a8e2687a636b155a53640b28fd1a70aa28
Instruction Fuzzy Hash: D121C6B5D002599FDB10CF9AD585ADEBBF4FB48320F14841AE918A3350D375A944CFA5

Function 011C7810 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 011C8110

Memory Dump Source

Source File: 00000007.00000002.2544508517.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11c0000_z68ORDER.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d274ad29fafff4af5f1cd97a2b53d04c1144fba4bb4dacd0d5bc976eb676f0f8
Instruction ID: bb9b4fe024269571a927180ce1cd418ef0ec5b4238ec9e8d193efd7560e8f89d
Opcode Fuzzy Hash: d274ad29fafff4af5f1cd97a2b53d04c1144fba4bb4dacd0d5bc976eb676f0f8
Instruction Fuzzy Hash: D42144B1C046599FCB14CF9AC4457AEFBF4EB48720F11812AD818B7340D378A944CFA5

Function 011C8098 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 011C8110

Memory Dump Source

Source File: 00000007.00000002.2544508517.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11c0000_z68ORDER.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 4aa401d33f204f1af7d10fef62442eb9e417826c865f6acff81b51e9be017fe6
Instruction ID: e434c96390b471510d798dffc9e63eebc79b66bbb905c19b3122c759e9072ca7
Opcode Fuzzy Hash: 4aa401d33f204f1af7d10fef62442eb9e417826c865f6acff81b51e9be017fe6
Instruction Fuzzy Hash: 1D2144B1C006599FCB14CFA9C5457EEFBF4AF48720F15816AD818B7241D378A944CFA1

Function 011CF650 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,011CF5D2), ref: 011CF6BF

Memory Dump Source

Source File: 00000007.00000002.2544508517.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11c0000_z68ORDER.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a99a782ca974d91b94dbabfb407bdb4d5dae158c3b981a496d9b68eeb428e4f6
Instruction ID: ba35f2aeed04c92e2cc7af1fecec9349d2214405915c5cde9f832832de580c4c
Opcode Fuzzy Hash: a99a782ca974d91b94dbabfb407bdb4d5dae158c3b981a496d9b68eeb428e4f6
Instruction Fuzzy Hash: 261136B1C0026A9BDB14CFAAC4487DEFBB4AB08320F11812AD918B3250D379A945CFA5

Function 011CEDCC Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,011CF5D2), ref: 011CF6BF

Memory Dump Source

Source File: 00000007.00000002.2544508517.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11c0000_z68ORDER.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 56b706c3ccdcf6aa9c5b85b12f98d4cf4b803ab1bc5d5f82c3af5ac08c7622d5
Instruction ID: 1605b2554e9ba4b3e08833c088ba10e8f980d4d8dc8d2d976a222b68ebf43cc3
Opcode Fuzzy Hash: 56b706c3ccdcf6aa9c5b85b12f98d4cf4b803ab1bc5d5f82c3af5ac08c7622d5
Instruction Fuzzy Hash: 671136B1C0065A9BCB14DFAAC44879EFBF4AB08320F11816AD918B7250D378A944CFA5

Function 067CC038 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 067CC09E

Memory Dump Source

Source File: 00000007.00000002.2559941370.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67c0000_z68ORDER.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 06e3ed111fdc2cda7daff85ca652ec5dab7ca0fdd23401967726c62a09011406
Instruction ID: 85c4b79907ada504bf27b338f4b72ee1f462e85c5dbc4c0e2e857e6626a3a675
Opcode Fuzzy Hash: 06e3ed111fdc2cda7daff85ca652ec5dab7ca0fdd23401967726c62a09011406
Instruction Fuzzy Hash: 7A110FB5C002498FCB10DF9AC844B9EFBF4EB88324F10842ED829A7200C375A545CFA1

Function 06824B83 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

XPdq, xrefs: 06824CBD

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: XPdq
API String ID: 0-1708276200
Opcode ID: 2c8115ed46990c4cbc013c74c1c86f39c316a43e20e84274adbd969acd795e02
Instruction ID: 1293e20893f6958cd39ecbce7686a3a7250978428fa0aa95486eba0314979f6c
Opcode Fuzzy Hash: 2c8115ed46990c4cbc013c74c1c86f39c316a43e20e84274adbd969acd795e02
Instruction Fuzzy Hash: A1419D74F102199FEB599BA5C854B9EBBF6BF88700F20C529E105EB395DA744C418BA0

Function 0682DE9D Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0682DFF9

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: ac9d73cac39f9be6f3b29a68470abc1e6dd3467ba443eb9d47611c30353a1ff3
Instruction ID: 7c0372ee5ceb67920728574377242a40aa691a8b4b311318b312a24125374870
Opcode Fuzzy Hash: ac9d73cac39f9be6f3b29a68470abc1e6dd3467ba443eb9d47611c30353a1ff3
Instruction Fuzzy Hash: F341B130E1031A9FDB64DF65C89469EBBB2BF85304F104529E905EB244EB75E886CB91

Function 0682DEB0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0682DFF9

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: bce59a9c212e4416db5f74874a7e5988e10db8a681e0b13e9c844385c64d88a3
Instruction ID: 3d57ab84af5be010f04cef1bcd8abb6310dfbf975e689ae32db2cf7f25540af3
Opcode Fuzzy Hash: bce59a9c212e4416db5f74874a7e5988e10db8a681e0b13e9c844385c64d88a3
Instruction Fuzzy Hash: 6041CF30E0031A9FDB64DF65C45469FBBB2BF89304F204929E901E7344EBB4E882CB95

Function 068225E5 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH_q, xrefs: 06822733

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 1c50314f7a316b2a9220460b49770df27f7ee80a4d8c5de9fda73077199b1cf1
Instruction ID: 7e52c308f3f524a36822da04b527c082f133aaacba6ccbe35389144b05a0bcf1
Opcode Fuzzy Hash: 1c50314f7a316b2a9220460b49770df27f7ee80a4d8c5de9fda73077199b1cf1
Instruction Fuzzy Hash: FD310131B003268FDB59AB74C5606AE7BE2EF89604F108578D506DB394DF39DE82C7A1

Function 068225F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH_q, xrefs: 06822733

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 3d6a7abe7d2a58fbe860a5ce33c0c0315da7e481375f5fdff95107d76172b6b4
Instruction ID: aaa587fa825dce0c5f1c862c3a3b8c9055afafbdc1b57d66d33d2516a3ba2e8c
Opcode Fuzzy Hash: 3d6a7abe7d2a58fbe860a5ce33c0c0315da7e481375f5fdff95107d76172b6b4
Instruction Fuzzy Hash: B631E231B002168FDB58AB74C56466E7BA3AF88604F108938D506DB394EF39DE82C7A5

Function 068282B8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$_q, xrefs: 06828303

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q
API String ID: 0-238743419
Opcode ID: 8dbfa628ee7a4baa3a97e7d7d0eeba5116ffcbfb99dbb85f9a2ee60aec84e6a4
Instruction ID: fa27bf1dec28b22f8e6c95ec9d3f11e5873e1e3807c1fd72ee45f107c6db278e
Opcode Fuzzy Hash: 8dbfa628ee7a4baa3a97e7d7d0eeba5116ffcbfb99dbb85f9a2ee60aec84e6a4
Instruction Fuzzy Hash: FEF0FFB1A0022BCFDF689A94EA962AC73A1FB40318F144426CA04DB644D731ED89CB90

Function 0682B213 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2305f50e09300d587e14ed413e314c7559edd1e5216c40916793acdf97dc9dd3
Instruction ID: 262c09636a4302ea74561bd162e07e30201bbe1e793b5f037fea341dd98eff57
Opcode Fuzzy Hash: 2305f50e09300d587e14ed413e314c7559edd1e5216c40916793acdf97dc9dd3
Instruction Fuzzy Hash: 53A1C670F1121A9FDF64CAACC9947AE77E6FB49314F208829E509EB395CA34DCC18791

Function 0682B628 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c63d322b30c92a45059e9348276e456e6e2cbf179027679f831ed610c4dcb5
Instruction ID: 35d0f57a8e01dc106ea6052c67faa3200d592c1d0fcbf143fa22bd928980d07d
Opcode Fuzzy Hash: f9c63d322b30c92a45059e9348276e456e6e2cbf179027679f831ed610c4dcb5
Instruction Fuzzy Hash: 29A15B30E1122B8FDFA0CA68C5C07ADB7B1FB49318F148926E559EB255DB34DC85CB51

Function 068261E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40f065eb55da5e268aeff427f9ef5cb07a9521ae550529b5cd2b5e9e615b1a9
Instruction ID: 16c2d893309b1daf55dd8fcbf3229caa449a6768cc85a522d3ad579e787e29c2
Opcode Fuzzy Hash: a40f065eb55da5e268aeff427f9ef5cb07a9521ae550529b5cd2b5e9e615b1a9
Instruction Fuzzy Hash: 5061CFB1F401224FCB549A6EC88066FBAD7EFC8224B254439D90EDB364EE65ED4287D1

Function 068242C0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3296fdfd3fcc47d98b645b93f981cab16dfc19cd4c3b039c5654b95d0a1ab0f
Instruction ID: f3d88ebd7708f4671508ac14319649be67f88c7ca1e46f348ad944d7f9e4bc64
Opcode Fuzzy Hash: c3296fdfd3fcc47d98b645b93f981cab16dfc19cd4c3b039c5654b95d0a1ab0f
Instruction Fuzzy Hash: 0B815E30B1021A8FDB54DFB4D55476EB7F2AF88304F108529D50AEB398EB74DC868BA1

Function 068245E0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9e01c6031f8e86046266d45e277e4f94d23ca41569385033d17839a5b3d0d6
Instruction ID: 98f610a887f6ed1c67c870c1279e49952d0c55ac3f86dcca606a1d867d867758
Opcode Fuzzy Hash: 8e9e01c6031f8e86046266d45e277e4f94d23ca41569385033d17839a5b3d0d6
Instruction Fuzzy Hash: 88915C30E1061A8FDF64DF68C880B9DB7B1FF89304F208599D549EB295DB70AA85CF91

Function 068242D0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c095e6bb5341451a65f8749def38b6c94291dfae756634d56d6fde42b1fd8c
Instruction ID: 3df316f531ec4225df5a5f4402226b5e2f004ede70fe756249b40e026fe4ed8c
Opcode Fuzzy Hash: b8c095e6bb5341451a65f8749def38b6c94291dfae756634d56d6fde42b1fd8c
Instruction Fuzzy Hash: B2814D30B1021A8FDB54DFB5D55475EB7F2AF88304F108529E50AEB398EB74DC868BA1

Function 068245F8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd7912a9fee00486ea7453d88910da1eac0548dab23c525255ce22ecfa6771e
Instruction ID: 40287d08ed607d7ab927a9d5c3b4391fdde29937ce31996139fde6d833444b6f
Opcode Fuzzy Hash: 3fd7912a9fee00486ea7453d88910da1eac0548dab23c525255ce22ecfa6771e
Instruction Fuzzy Hash: 63913C34E1061A8BDF64DF68C880B9DB7B1FF89304F208599D519EB295DB70AA85CF90

Function 0682EEE7 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c74daa7570b4d071b5219da8b56fd10826075bd147ae2a0b5a0090f786b2903
Instruction ID: 62f527c8512dc42a196e7de91808a121df4827c8226520d62375868d4cd158ac
Opcode Fuzzy Hash: 3c74daa7570b4d071b5219da8b56fd10826075bd147ae2a0b5a0090f786b2903
Instruction Fuzzy Hash: 3A713F70A0121A9FCB54DFA8D994AAEB7F6FF88304F148469D519EB354DB30EC86CB50

Function 0682EEF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b669604f779210997fa4010508b9922594a76200a3057e7b71cbbe890a2724
Instruction ID: 4ca20fad1eb2e3ff825c58298eda28cafd3159990979a6b6a10c216914c0f30e
Opcode Fuzzy Hash: 19b669604f779210997fa4010508b9922594a76200a3057e7b71cbbe890a2724
Instruction Fuzzy Hash: E1714F70A0121A9FCB54DFA9D990AAEB7F6FF88304F148469D115EB354DB30EC86CB50

Function 0682FC68 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96ec112fb48bba66a88213ce68699dc21c2bb97744a36df5277e2c9f73cfcd9
Instruction ID: cb238eef5be02774ff142e6a254f31458d142bcadf920e59320073b5c6c7eeda
Opcode Fuzzy Hash: f96ec112fb48bba66a88213ce68699dc21c2bb97744a36df5277e2c9f73cfcd9
Instruction Fuzzy Hash: 34510335E00126DFDF24EB78E4542ADBBB2FF88315F108879E20ADB250DB359895CB81

Function 0682FA0B Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa53d1a2107609b8a4c2667b73ae8f7331278361d59387371574d4ed8265675c
Instruction ID: 94ad702fa12846d85693597bce090cf196a501ac9a93a4e001686f26b8a1e39c
Opcode Fuzzy Hash: aa53d1a2107609b8a4c2667b73ae8f7331278361d59387371574d4ed8265675c
Instruction Fuzzy Hash: 8351EB30B502269BEF64666CD96472F3676D789744F10482AF30AD77DCDA38CC95C3A2

Function 0682FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfcdea80341daddf3b4ed3eddde9dbe2caead7d216c8f81c6311388f5abb5a2f
Instruction ID: 4a66d183772e5a90de8f9722aeca7dfa3908a8d483ee489345a71b66df7c3740
Opcode Fuzzy Hash: dfcdea80341daddf3b4ed3eddde9dbe2caead7d216c8f81c6311388f5abb5a2f
Instruction Fuzzy Hash: 72510B30B502269BEF54666CD96472F3666D789704F20482AF60AD37DCDE34CC85C3A2

Function 06825448 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb6c3c0ab926618e4830ff39fee63375d1a3dd296557413765fb9c5c538f090
Instruction ID: 3c28f5425a04ee8ad3e9c971c6470b7652a51946dcb63afe396e5d212433c9fe
Opcode Fuzzy Hash: ecb6c3c0ab926618e4830ff39fee63375d1a3dd296557413765fb9c5c538f090
Instruction Fuzzy Hash: E6414F71E4061A9FDF70CFA9D981AAFF7B2FB84310F10492AD215D7650D330E8958B92

Function 0682FC57 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9117d54cec428ef058f7334065e9544baff294b7198e9be201601ca4f4cbb5
Instruction ID: a5727941edc373c3bde677ab10139117d0247c7ebc4833e9dfba52da71c5efb5
Opcode Fuzzy Hash: 2a9117d54cec428ef058f7334065e9544baff294b7198e9be201601ca4f4cbb5
Instruction Fuzzy Hash: D5413731A001269FCF69AB78E4540AEFBB2FF84205F108879D20ACB251DF319C96C792

Function 068255B8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08483ab67cfc95bbd6d03853ac1cf2ad745e75cddb9b7efa535a06cd38a6ed77
Instruction ID: 3314cfcab94c6800565011843bd12c669f80d20bb99fd47801cc0ace13e8132d
Opcode Fuzzy Hash: 08483ab67cfc95bbd6d03853ac1cf2ad745e75cddb9b7efa535a06cd38a6ed77
Instruction Fuzzy Hash: AD31B470E502169FDF708BA9C8C077EF7B2FB85310F64882AD659D7241C635D981CB92

Function 0682DD50 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddce973a640f7623d0b963389b0065862ddb19c13ac0eee41ba82a53cd47c7db
Instruction ID: 10356f22252cd1ae2431cfcb63f5f4b3f3dde908db65cc8363c2d40987ec1155
Opcode Fuzzy Hash: ddce973a640f7623d0b963389b0065862ddb19c13ac0eee41ba82a53cd47c7db
Instruction Fuzzy Hash: C731C730E1071B9FCF15DF64D99069EBBB6FF85304F508929E505EB354EB71A8868B80

Function 068224B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a388bbcef3c536c0d334ef2810dd13309242dc777c38c53454d41e6ad8d6e7f
Instruction ID: 74ef6170e0682ec090989909f57bdc8e825a6dd6384412cd3812be13667a09da
Opcode Fuzzy Hash: 7a388bbcef3c536c0d334ef2810dd13309242dc777c38c53454d41e6ad8d6e7f
Instruction Fuzzy Hash: 8F315C34E1061A9BCB59CF64D96469EB7B2FF89310F10C529E806E7758DB70AD82CB50

Function 06825FE0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5ea548544aa132f3b634ed51638fd2115e6d1db829f908f8d51e849f55c28e
Instruction ID: 9b6bec067f2b123bccb41d3309e73a10ce62d6d53ca4c3f6c561c14ae05ef561
Opcode Fuzzy Hash: 1b5ea548544aa132f3b634ed51638fd2115e6d1db829f908f8d51e849f55c28e
Instruction Fuzzy Hash: 6D31D035B200248FCB54DF78C498A5EBBE2FF8C710F2184A9E506DB3A2DA71DC448B90

Function 06823EC9 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fb451cba5a6434b8089f00c40a0f92cf389798098b73e091ff7046c25e1e11
Instruction ID: 431da7d2fad8b62c4bdf19e26d0ac06f16da5d27a40a5e7c07184450e06308d2
Opcode Fuzzy Hash: 76fb451cba5a6434b8089f00c40a0f92cf389798098b73e091ff7046c25e1e11
Instruction Fuzzy Hash: 19218D35F0125A9FDB00DF68D991BAFBBF6AB48210F10842AE905E7384E774DD418B91

Function 06825FF0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dad3e84d17748577f18a0ebf0c912c8334e1cb4bb56591aa5e472725ab7ff5c
Instruction ID: bebc10e215c93a208d2c00736b3c973f5805ef5b38ba27d3ce7e71d7b1d66c44
Opcode Fuzzy Hash: 5dad3e84d17748577f18a0ebf0c912c8334e1cb4bb56591aa5e472725ab7ff5c
Instruction Fuzzy Hash: B3216235B200248FCB54DF69C498A5EB7F6FF8D710F2184A9E506DB3A5DA71DC448B90

Function 06823ED8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255ce8f24b691eb39a097a9ac8fb0de56b846b391b487e273a37353206cc9c92
Instruction ID: a347e388d45113fd8ecc6ebf31bf0f62811219232b9d88b3965f05767113a75e
Opcode Fuzzy Hash: 255ce8f24b691eb39a097a9ac8fb0de56b846b391b487e273a37353206cc9c92
Instruction Fuzzy Hash: 3A218E75F012169FDB40DF69E991BAEB7F1EB48710F108029EA05E7344E774DD418B91

Function 06825439 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04dec2ea1caa92fb66839848aeed9d609b2b75cb7cc53a3341170ad735e4921c
Instruction ID: 5b493255b1c4be1366a16aa7e09ca943b5c003972c2670e59a2f971857cd052b
Opcode Fuzzy Hash: 04dec2ea1caa92fb66839848aeed9d609b2b75cb7cc53a3341170ad735e4921c
Instruction Fuzzy Hash: C3216D71A407168FCB70CFA9C9806AEFBF2FF85310F10492AD255D7651D370A8958B92

Function 0113D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2544075088.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_113d000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8734a3293aebbde25801ad91915540019278a6f9439f30e461135badc7c44b
Instruction ID: 69676e474c97aa0c0a15096a077a0bd877b14d0e9f612ac23099c511c32d5c68
Opcode Fuzzy Hash: ea8734a3293aebbde25801ad91915540019278a6f9439f30e461135badc7c44b
Instruction Fuzzy Hash: A62134B1504204DFCF19CFA8E9C0B26FB65FBC4714F60C5ADE8490B25AC73AD44ACA62

Function 06823FE8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2164cb92360302630f325d44be87582be0f04cace1d9d5b7994c3f77c03a248d
Instruction ID: 79a97269b343f7394645a01f1bb1c96a85b5a8cbf235375c918232878feb9132
Opcode Fuzzy Hash: 2164cb92360302630f325d44be87582be0f04cace1d9d5b7994c3f77c03a248d
Instruction Fuzzy Hash: 7411C435B1013A5FDF949678D8146AE73EAEBC8711F008439D50AE7344EE76DC468BE1

Function 06823CA0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8cf4b93f68f3b977e40782e6604f57b57e2bad531b3bcbf54fd1fafb49e0d1
Instruction ID: 82c1bd96b53d6ded63307e50181a309ae86edf1f304668db71a39aa0898bc0b3
Opcode Fuzzy Hash: dd8cf4b93f68f3b977e40782e6604f57b57e2bad531b3bcbf54fd1fafb49e0d1
Instruction Fuzzy Hash: E521E5B5D01229AFCB40DF9AD984ADEFBB4BB48314F10851AE518B3300D3796954CFA5

Function 0682A2F0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5812f344c938664eb918ac51c64c314e6c0fb8049ae68838171eb394af8d693
Instruction ID: c0f52657847efe7e2fce81fe56fb8505e99b0c5d2b02a7d6298e0c4c3ad49541
Opcode Fuzzy Hash: a5812f344c938664eb918ac51c64c314e6c0fb8049ae68838171eb394af8d693
Instruction Fuzzy Hash: 29114430B102261FC756DA38E864B2E7BE5FF46324F10C479E209CB2A2DA21DC4283A1

Function 06824223 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f31ffdb4c10b063aa2c4301f6ceb02f867761e1110d6bf62fbf448dd6d57f8
Instruction ID: a25de5e9c8a7e4172703ebe4d011b6999717bb91cd0a8df91efebaa1fc6d5069
Opcode Fuzzy Hash: 64f31ffdb4c10b063aa2c4301f6ceb02f867761e1110d6bf62fbf448dd6d57f8
Instruction Fuzzy Hash: 3D01B1B5B100230FCB95DABED55172EABDADBCD720F20843AE60ACB355E925CC4243B4

Function 06822154 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ecaead07d62838d10c426617b3c5b636890c5d3c7b8570541acda2d959f1db
Instruction ID: 4630eec239b7046a309e193cc78dd2fc42bdea58e967409f4fe642101e8b1f18
Opcode Fuzzy Hash: 12ecaead07d62838d10c426617b3c5b636890c5d3c7b8570541acda2d959f1db
Instruction Fuzzy Hash: 8021F4B1D01219AFCB00DF9AD884ADEFBB4FB48314F10812AE918B7200C378A944CFE5

Function 0682F167 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fed4e0feca509903d5b10e29f46fb6cb6c4c1bec4b453e3bc9da4d6a6a6aa9
Instruction ID: 758ee398331bc8af6b85effe55e5511d10711f0112507a90e5a29468d6e44f75
Opcode Fuzzy Hash: 35fed4e0feca509903d5b10e29f46fb6cb6c4c1bec4b453e3bc9da4d6a6a6aa9
Instruction Fuzzy Hash: 55012835B141224FDB56DA7CD86072E6BF2DBCA214F54C83AE20AC7345DA24CC82C3A1

Function 06823FD7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baad641fd5faca8e99499cd8ba4e2e8fde94960bcd1877e42bef03ec8a07fcb4
Instruction ID: e25977a2911ba90f4701b33a9b0f3693daccadea65bd022b1c4373a973bbcbf3
Opcode Fuzzy Hash: baad641fd5faca8e99499cd8ba4e2e8fde94960bcd1877e42bef03ec8a07fcb4
Instruction Fuzzy Hash: F701AC36F101265BDF949579D8107AF73FAABC8710F408035D50AE7344EE66DC4687E2

Function 0113D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2544075088.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_113d000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 1580021f9c933eb6b419bcd631a4e25096ae5654fc26315d26578811b21cf37d
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 7C11BB75504284CFDB16CF64D9C4B15FBA2FB84314F24C6A9E8494B256C33AD44ACB62

Function 06824230 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc82af909a239846432a8c32558bde6934b6c1a6460927bd6f56284832053669
Instruction ID: 47da86f7d01119dfb94bf27e2d2f8862a4df77ab36e2d029755693fc17089c1e
Opcode Fuzzy Hash: dc82af909a239846432a8c32558bde6934b6c1a6460927bd6f56284832053669
Instruction Fuzzy Hash: 1601D174B100220BDB64D9AED45072FA6DADBCD720F10C43AE60AC7354EE65DC4243B4

Function 0682F178 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fbdc9e1cf46b3c7dec447677586f3c0304524bbf3b5f1ab6fedb42f97f556d
Instruction ID: 6f977b74482e158591efddff81f71fc5df232e10787ab6c63f2a53256df72409
Opcode Fuzzy Hash: 35fbdc9e1cf46b3c7dec447677586f3c0304524bbf3b5f1ab6fedb42f97f556d
Instruction Fuzzy Hash: B001F934B100225BDB55D57DD86072E67E6D7C9624F50C839E70AC7344EE25DC8283D5

Function 0682A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3944ff292db5ef441a59b9b175b981d003da45a97b8fc8f29874ef1bf24fe31
Instruction ID: c8cd2c7e6df858b7ce722caddbb3a5a659381d50ad0ba4516b9d6196e900809e
Opcode Fuzzy Hash: b3944ff292db5ef441a59b9b175b981d003da45a97b8fc8f29874ef1bf24fe31
Instruction Fuzzy Hash: 5801A434B601265FCB58EA7CE854B2E77D5FF89714F108439E60AC7354EE21DC424394

Function 06826460 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cea706791a1f3ad5989480e8de699060123e003a5781635d6ff115fc7650128
Instruction ID: 2930b7398facc72529a82578b12f3badb77389c2b674548bad8593bde8ea96a6
Opcode Fuzzy Hash: 4cea706791a1f3ad5989480e8de699060123e003a5781635d6ff115fc7650128
Instruction Fuzzy Hash: D7F05570E09209BBDB31CEB0C80976E7769EB02228F2088A5E488CF151F533CBC18780

Function 06826470 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb783ad8ddd0b625cd7748f5eb138bca677bf42f01657a5ee64e5022ce74967
Instruction ID: 1b5dd4b1ca8100bc4fff4978fb5efb6e0405ae72d64c7649581a1b8ff2968c8a
Opcode Fuzzy Hash: fdb783ad8ddd0b625cd7748f5eb138bca677bf42f01657a5ee64e5022ce74967
Instruction Fuzzy Hash: 11E0C270E1111EABDF60CEB4C95576EB3ADE701214F2088A4D549CB201F132DAC14380

Non-executed Functions

Function 06827688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$_q, xrefs: 06827B35
$_q, xrefs: 06827BEA
$_q, xrefs: 068277B5
$_q, xrefs: 06827B41
$_q, xrefs: 068277A9
$_q, xrefs: 06827BF6
$_q, xrefs: 06827778
$_q, xrefs: 06827BD4
$_q, xrefs: 06827784
$_q, xrefs: 06827BE0

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-698649689
Opcode ID: ca93da003883859d38bc9b73d77c5216541e73a0258555c0b72a12516ab38e38
Instruction ID: 6dbcd2ef96f9eb721b2003fc9cfa7b30726ff11399eb0184231e168f1cec7389
Opcode Fuzzy Hash: ca93da003883859d38bc9b73d77c5216541e73a0258555c0b72a12516ab38e38
Instruction Fuzzy Hash: F5122D30A0022ACFDB68DF79C994A6DB7F2BF89704F208569D509EB354DB309D81CB81

Function 0682A928 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$_q, xrefs: 0682AAE6
$_q, xrefs: 0682AA2A
$_q, xrefs: 0682AADA
$_q, xrefs: 0682AAA4
$_q, xrefs: 0682AAB0
$_q, xrefs: 0682AA79
$_q, xrefs: 0682AA1E
$_q, xrefs: 0682AA85

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: d318e18aece4750054bfdccd97a34e2918f2f6cb7c7baa4a793fe75ce75116f7
Instruction ID: baa469e1103a59bf51c628d517fbabd7cf697bcfb39a36e5aefceae9f4dc76e7
Opcode Fuzzy Hash: d318e18aece4750054bfdccd97a34e2918f2f6cb7c7baa4a793fe75ce75116f7
Instruction Fuzzy Hash: 63918E30A0021BDFDB6CDF64D695B6E77F6AF84B04F108429E402EB294DB759C85CB90

Function 06827088 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$_q, xrefs: 068273C4
$_q, xrefs: 06827524
$_q, xrefs: 06827590
.5wq, xrefs: 068270E3
$_q, xrefs: 0682759C
$_q, xrefs: 0682736A
$_q, xrefs: 068273D0

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: .5wq$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-3129995876
Opcode ID: 959efe98abb3f1f0d8cbdf4094c66639bf5797ba5302e5cc68348fc05b2a1336
Instruction ID: 8a630f95c15026b1882d8807efd06f801b9b069e13d98b8dd9f8ada3e785138e
Opcode Fuzzy Hash: 959efe98abb3f1f0d8cbdf4094c66639bf5797ba5302e5cc68348fc05b2a1336
Instruction Fuzzy Hash: 9DF15D34A0021ACFDB58EB69D594A6EB7B3FF98304F208528D415DB758DB35EC86CB80

Function 0682BDE8 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$_q, xrefs: 0682BFF5
$_q, xrefs: 0682BF81
$_q, xrefs: 0682BF8D
$_q, xrefs: 0682BFC1
$_q, xrefs: 0682BFB5
$_q, xrefs: 0682BFE9

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: 8c58f8292ac8021f7f4d5ba6b47929f0fce20cb6b607c48705fb2348f72dfcad
Instruction ID: b1316bb7c780844a087d98eff63f2cb49bb1b2f3ee87c91b3360d050e1437176
Opcode Fuzzy Hash: 8c58f8292ac8021f7f4d5ba6b47929f0fce20cb6b607c48705fb2348f72dfcad
Instruction Fuzzy Hash: A271C074A1122B8FCBA8CFA8D5406AEB7B2FF84708F108929D505DB254DBB1DD85CB81

Function 068283C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$_q, xrefs: 0682867F
$_q, xrefs: 0682861A
$_q, xrefs: 0682868B
$_q, xrefs: 06828626

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 3f64768030782cfb4e6dab0da383078a4e762d802535e518a8723d881b3aea6b
Instruction ID: d21c881ffae6f27ee972135b02ea8f5ff32a8de3270f841537d5fa6e752b3af4
Opcode Fuzzy Hash: 3f64768030782cfb4e6dab0da383078a4e762d802535e518a8723d881b3aea6b
Instruction Fuzzy Hash: D0B12B74B1021A8FDB68EB69C59465EB7B2FF98304F248829D505DB358DB74DC8ACB80

Function 0682ACA8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$_q, xrefs: 0682AE5B
$_q, xrefs: 0682ADD9
$_q, xrefs: 0682AE84
$_q, xrefs: 0682AE2C

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: ff84501a663fec3443a1097900568ebc81e32e6127b570fd08b0bab08d59bb89
Instruction ID: 558f8df37d0c3b3cb9fdd53ca808d1bfaf6d0b475306506861f33325c6fb8fb4
Opcode Fuzzy Hash: ff84501a663fec3443a1097900568ebc81e32e6127b570fd08b0bab08d59bb89
Instruction Fuzzy Hash: 62517034E102169FDF6DEB68D5806ADB7B6EF88714F108929D905E7354DB31EC82CB90

Function 068287D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$_q, xrefs: 06828863
$_q, xrefs: 06828857
LR_q, xrefs: 0682891A
LR_q, xrefs: 068288CB

Memory Dump Source

Source File: 00000007.00000002.2560769623.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6820000_z68ORDER.jbxd

Similarity

API ID:
String ID: LR_q$LR_q$$_q$$_q
API String ID: 0-2912794808
Opcode ID: d75c14a7bd10d5bfb6afd1f7dccfca63592c262095741b302eee0da4ea9fb4c5
Instruction ID: e295ddcd0624e32a03be86d22cb6db7b82762821f1dab742b7f6f21fe14f46ff
Opcode Fuzzy Hash: d75c14a7bd10d5bfb6afd1f7dccfca63592c262095741b302eee0da4ea9fb4c5
Instruction Fuzzy Hash: 9551C130B002169FDF58EB28C951A6E77E2FF88708F148969E505DB399DB30EC95CB91

Analysis Process: mpTrle.exePID: 8116, Parent PID: 2592COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	386
Total number of Limit Nodes:	19

Executed Functions

Function 0702A6C1 Relevance: 3.1, APIs: 2, Instructions: 87
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0702A66E
VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0702A736

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: AllocContextThreadVirtualWow64
String ID:
API String ID: 2727713192-0
Opcode ID: ff98356655a62a8e6600af55547545fcc0c80372e45d0718e5ec01ec108c143a
Instruction ID: 2b6ba340e1756296ff05ec3e042e29f25a40de3d8326b664285c81e764a83b86
Opcode Fuzzy Hash: ff98356655a62a8e6600af55547545fcc0c80372e45d0718e5ec01ec108c143a
Instruction Fuzzy Hash: 2B3189B2D003098FCB20DFAAC8497DEFBF4AF48320F14841AD519A7250DB799545DFA4

Function 0702AE04 Relevance: 1.8, APIs: 1, Instructions: 252
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0702B046

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1de1cf66137260ee122701e0b34b4994cb381a3f78e51de0fa2c891a1c22e962
Instruction ID: ef54baea2252f682fac5202dccdcf94b18ca3fb6551a7646c76cf57373f54653
Opcode Fuzzy Hash: 1de1cf66137260ee122701e0b34b4994cb381a3f78e51de0fa2c891a1c22e962
Instruction Fuzzy Hash: 74A15FB1E00229DFDF50DF68C8417DDBBF2AB44314F14826AD859A7240DB749986DF91

Function 0702AE10 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0702B046

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5d1e0f71bfda40306d4ccf6fc1042c81357d59ed4ce6486a8b2c6a167c577441
Instruction ID: 25d7ffec846119b80cad4abf604b83cadaa1819104773761fe194d496a184f0f
Opcode Fuzzy Hash: 5d1e0f71bfda40306d4ccf6fc1042c81357d59ed4ce6486a8b2c6a167c577441
Instruction Fuzzy Hash: 6C915EF1E0062ADFDF60CFA8C8417DDBBF2AB44314F14826AD859A7240DB749986DF91

Function 02E2ADA8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02E2AFFE

Memory Dump Source

Source File: 00000009.00000002.1440019950.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e20000_mpTrle.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eed8f2a071ef050b05f012077e1e0caa8fd34d389d39500f0999b0231411ea5f
Instruction ID: 9e96cbf6014b42affa8d47ca3912d794b8b46164e01c7128e12adf138b9dd31f
Opcode Fuzzy Hash: eed8f2a071ef050b05f012077e1e0caa8fd34d389d39500f0999b0231411ea5f
Instruction Fuzzy Hash: C571F270A00B159FD724DF2AD54575ABBF5BB88308F008A2DE48A97B50DB75E84ACB90

Function 054318E4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05431A02

Memory Dump Source

Source File: 00000009.00000002.1442674911.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5430000_mpTrle.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9df60e8635959784c59ee3fc5f47c650daf6d96553a45b320735490eadf96bc9
Instruction ID: 3bae7bdfde6a99431381a64f240dc3ae6c3aeb36c0491d5ed6efe170d047377f
Opcode Fuzzy Hash: 9df60e8635959784c59ee3fc5f47c650daf6d96553a45b320735490eadf96bc9
Instruction Fuzzy Hash: 0E51A0B1D003499FDB14DF99C985ADEFBB5BF48310F64812AE819AB210D7719945CF90

Function 054318F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05431A02

Memory Dump Source

Source File: 00000009.00000002.1442674911.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5430000_mpTrle.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9e72a033ac92bd82c0a02c2f9ddc4820584aef688757acfeaca54bce46a34936
Instruction ID: 7c03e47d8e2e35902b788d76a2244306ee9e23321156d84e858054003e10c20a
Opcode Fuzzy Hash: 9e72a033ac92bd82c0a02c2f9ddc4820584aef688757acfeaca54bce46a34936
Instruction Fuzzy Hash: 4341B0B1D003499FDB14DF99C885ADEFBB5BF48310F64812AE819AB220D7719985CF90

Function 02E244C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02E259C9

Memory Dump Source

Source File: 00000009.00000002.1440019950.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e20000_mpTrle.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7577db6b515c23cbc84d1db8b1c18248308ab9db91f531d13b2b9d06524f2836
Instruction ID: b15216fddfa89d55b081481ce6ded79a6565ae9beec106ef0bb156bd8a35ff2f
Opcode Fuzzy Hash: 7577db6b515c23cbc84d1db8b1c18248308ab9db91f531d13b2b9d06524f2836
Instruction Fuzzy Hash: 1641F2B1C0072DCBDB24CFA9C985B9EBBB5BF48304F64806AD409AB255DB716949CF90

Function 02E2590C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02E259C9

Memory Dump Source

Source File: 00000009.00000002.1440019950.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e20000_mpTrle.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2450a1b038c14bd2621d37a72b81cf7831317735ad153ac1d742dd8ea25f641f
Instruction ID: c8554316b6e7bce707213925310e18a3576eb69a85c553ae87950cca7d147880
Opcode Fuzzy Hash: 2450a1b038c14bd2621d37a72b81cf7831317735ad153ac1d742dd8ea25f641f
Instruction Fuzzy Hash: EA41F3B1C0071DCFDB24CFA9C985B9EBBB5BF49304F60806AD409AB255DB715989CF90

Function 05434040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05434101

Memory Dump Source

Source File: 00000009.00000002.1442674911.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5430000_mpTrle.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ed59449d2aa658fcf67c52d472340748831039665bf51d265465a41a61a8f9d4
Instruction ID: 60a780a517114eb5c78e753cb9d521f476040ee99cb130737f71935d3cda40a7
Opcode Fuzzy Hash: ed59449d2aa658fcf67c52d472340748831039665bf51d265465a41a61a8f9d4
Instruction Fuzzy Hash: AF4116B5A003098FCB14CF99C449AAABBF5FB8C314F25C499D519AB321D735A845CFA0

Function 0702A951 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0702A8F8

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e7fee3f86e2e197d066a7e259065a16cb8861be34641092b31b25a6d85aedee5
Instruction ID: bfa74061dd5e740f33779cd9efe353b8c0e107fa2b8a568a3f729e5d8839815b
Opcode Fuzzy Hash: e7fee3f86e2e197d066a7e259065a16cb8861be34641092b31b25a6d85aedee5
Instruction Fuzzy Hash: 27318AB2D003198FDB20DFAAD8457DEFBF4AF48320F25841AD459A7250DB38A546DBA0

Function 0702A780 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0702A818

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7a0bdecb76f1eda0c874bc978db35ab9876772f098c993525917d827b4c89fa3
Instruction ID: d6ffcd7566fb524e8548104190054034adf7c1168d49aa1c9f5fe6727e53df70
Opcode Fuzzy Hash: 7a0bdecb76f1eda0c874bc978db35ab9876772f098c993525917d827b4c89fa3
Instruction Fuzzy Hash: 5E2137B29003199FCB10DFA9C985BDEBBF5FF48310F10842AE919A7240DB749945DFA4

Function 074D3394 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,074D4925,?,?), ref: 074D49D7

Memory Dump Source

Source File: 00000009.00000002.1443322960.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_74d0000_mpTrle.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: b95125005bca8dcce19beb59d0ee04e81401aa042fc39aa8d0c0c11b1efd438d
Instruction ID: 20caf44244ecc34f083d27487a124c43003d75f6729b61d5d5a6a690e0eb5a1d
Opcode Fuzzy Hash: b95125005bca8dcce19beb59d0ee04e81401aa042fc39aa8d0c0c11b1efd438d
Instruction Fuzzy Hash: E43102B5D003499FDB10CFAAD884ADEFBF5EB48320F14842AE959A7310D774A945CFA0

Function 074D493A Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,074D4925,?,?), ref: 074D49D7

Memory Dump Source

Source File: 00000009.00000002.1443322960.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_74d0000_mpTrle.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 8f734489cadcaa21c5919b8c17c8bd5ed6afce96bff7565ee927b5aba41d2a26
Instruction ID: 2dcc685ddda0d9fcd8ab5754809538a07a1f712caee0c4dba9e6ea124c9626b1
Opcode Fuzzy Hash: 8f734489cadcaa21c5919b8c17c8bd5ed6afce96bff7565ee927b5aba41d2a26
Instruction Fuzzy Hash: 8531C0B5D003499FDB10CFAAD884ADEFBF5EB48320F14842AE959A7310D774A945CFA0

Function 0702A788 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0702A818

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 83893e5ae7c69a9dee3bb930712a89f85e697a5b3aba74c9c931231db359fa6f
Instruction ID: 169b015f5ed7236795222151cf29d7e9c1e2d71f6da8d3c39d357e32ae8916fa
Opcode Fuzzy Hash: 83893e5ae7c69a9dee3bb930712a89f85e697a5b3aba74c9c931231db359fa6f
Instruction Fuzzy Hash: A02157B2D003199FCB10DFA9C985BDEBBF5FF48310F10842AE919A7240CB789945CBA4

Function 0702A5E9 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0702A66E

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6977812838bb823ebc201728249873e03f74302f7244d4af22f16c02dc259210
Instruction ID: c95f5b553be75fc9e348757e9825eb1e9c1872f088d29f8eb13ea2cd0557e8c6
Opcode Fuzzy Hash: 6977812838bb823ebc201728249873e03f74302f7244d4af22f16c02dc259210
Instruction Fuzzy Hash: AA2145B19003099FCB10DFAAC4897EEFBF4EB48324F10842AD459A7240CB78A945CBA4

Function 02E2D27C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02E2D656,?,?,?,?,?), ref: 02E2D717

Memory Dump Source

Source File: 00000009.00000002.1440019950.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e20000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5abf1e48fccf4c7bc51f834f83915dd492f5738db1c7bd29488e5302c4f592fd
Instruction ID: f96ff1b58aaaf1a6d278c7fbe99a6fa7684078136c7cf265f746da1b688fd071
Opcode Fuzzy Hash: 5abf1e48fccf4c7bc51f834f83915dd492f5738db1c7bd29488e5302c4f592fd
Instruction Fuzzy Hash: A621E5B5D003589FDB10CFAAD985ADEFBF4EB48310F14841AE919A3310D374A954CFA5

Function 0702A870 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0702A8F8

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3f5dce6dd1ad67f427826e2077746ba6c2c26ca8ceeed02b0e7387ec85cff956
Instruction ID: 0762a6e47570b9844977bfc20e516929bb60dd6220fd62e536dd30c14deb4cbc
Opcode Fuzzy Hash: 3f5dce6dd1ad67f427826e2077746ba6c2c26ca8ceeed02b0e7387ec85cff956
Instruction Fuzzy Hash: 612148B2D003599FCB10DFAAC8856EEFBF5FF48310F10842AE559A3250C7349946CBA0

Function 02E2D689 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02E2D656,?,?,?,?,?), ref: 02E2D717

Memory Dump Source

Source File: 00000009.00000002.1440019950.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e20000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2102cbccaf415f868c1674dcb11748588fc2dbadeea6d30cb39d8f2144ebf6ad
Instruction ID: 30871007b00a8bafedbdbb025ded2eeff2cc426ddfe2920ffdea47f8089afb0f
Opcode Fuzzy Hash: 2102cbccaf415f868c1674dcb11748588fc2dbadeea6d30cb39d8f2144ebf6ad
Instruction Fuzzy Hash: F32103B5D00308AFDB10CFAAD984ADEFBF4EB48314F14801AE918B3210D378A945CFA4

Function 0702A5F0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0702A66E

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 56383bc8eab106e3f446a5dfc817bef24b711e047e5d7f0615d00f603341805d
Instruction ID: 3eccf4fb7cca1cacae452a3cac7a907cdba443c225980116238c7f6560682f91
Opcode Fuzzy Hash: 56383bc8eab106e3f446a5dfc817bef24b711e047e5d7f0615d00f603341805d
Instruction Fuzzy Hash: 962137B1D003198FDB10DFAAC4857EEFBF4AB48314F10842AD419A7240CB789945CBA4

Function 0702A878 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0702A8F8

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9448362c9d74eafbe18580c4e83a51e7dbea96dd6c8c8498108c7adb069abc99
Instruction ID: b4b042fe25fe3c0ad9f1b6df07fbea3eaf9429ad77e6b10d2e4fcaa57ca0e497
Opcode Fuzzy Hash: 9448362c9d74eafbe18580c4e83a51e7dbea96dd6c8c8498108c7adb069abc99
Instruction Fuzzy Hash: 352139B1D003599FCB10DFAAC885ADEFBF5FF48310F50842AE919A7250C7759945DBA0

Function 0702A100 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0702A16A

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1ab030b3330e4ed6a2b012a4aaab839a0adc0f868b7af54334d86c0322e8d8c8
Instruction ID: c47173c90d30aaca0077da37b14239c656ff619e184b005c0a119d3fc59d04cd
Opcode Fuzzy Hash: 1ab030b3330e4ed6a2b012a4aaab839a0adc0f868b7af54334d86c0322e8d8c8
Instruction Fuzzy Hash: BF1134B1D003099FCB20DFAAC8457DEFBF4AF89324F20841AD419A7240DB75A945CBA4

Function 0702A6C8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0702A736

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a38e988a993ae7251e76124abeafebce2db4598505c45784c7c6b5b01bb3e423
Instruction ID: a4cda893d44370f10ab6ec6de9e42a58fc3236ffa100144dc1b9a229173f31d0
Opcode Fuzzy Hash: a38e988a993ae7251e76124abeafebce2db4598505c45784c7c6b5b01bb3e423
Instruction Fuzzy Hash: F61126B29002499FCB20DFAAC845ADEFFF5AB48320F108419E519A7250CB75A945DBA4

Function 0702A108 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0702A16A

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e995c1c0b52280250dbc8ebb60a8024cfa9369a4c62c6975e29b32c89e822c52
Instruction ID: debe18611963369cddc4bb51e53d4a846942ba384266934db1ae668ec778bda1
Opcode Fuzzy Hash: e995c1c0b52280250dbc8ebb60a8024cfa9369a4c62c6975e29b32c89e822c52
Instruction Fuzzy Hash: A3113AB1D003598FDB20DFAAC4457DFFBF4AB88324F108419D419A7240CB756945CBA4

Function 02E2AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02E2AFFE

Memory Dump Source

Source File: 00000009.00000002.1440019950.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e20000_mpTrle.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 916b9a50d61ce2a9eae5bad05d94e6548a622d54f8c1691f815907f5ec3630c2
Instruction ID: 96cd4649651bde4b7b00e69198b3976ee30616b287f6e058eb298ffda0f0cfb7
Opcode Fuzzy Hash: 916b9a50d61ce2a9eae5bad05d94e6548a622d54f8c1691f815907f5ec3630c2
Instruction Fuzzy Hash: CC1113B5C003498FCB10CF9AC444BDEFBF4AB48318F14842AD429B7210D375A549CFA1

Function 0702AA18 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0702D33D

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 71885689f81826ad97a2e9b4d78e6bc48df2263ee4b3157ec64c75b91c593118
Instruction ID: db15f56bd7c2fac6b5a3e35020db073c97a19aeae7f6dba2d51eeb8e6ae59681
Opcode Fuzzy Hash: 71885689f81826ad97a2e9b4d78e6bc48df2263ee4b3157ec64c75b91c593118
Instruction Fuzzy Hash: 511133B68003089FCB10DF9AD489BDEFBF8EB48310F108419E958A3200C375A944CFA4

Function 0702D2D9 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0702D33D

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 15d230b07cb282cce8df9dcd6e4d623faa0e6449fb400e5b06e5e37bb4d4dbc2
Instruction ID: e588e573a11e690b33d26226d21d24cf70dadbccdb71f6e532eace9240cc6246
Opcode Fuzzy Hash: 15d230b07cb282cce8df9dcd6e4d623faa0e6449fb400e5b06e5e37bb4d4dbc2
Instruction Fuzzy Hash: FB11F2B6900359DFCB10DF99D889BDEFBF4EB48314F20845AE558A7200C375A989CFA1

Function 0702DD60 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0702E759,?,?), ref: 0702E900

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2bbe2c0954d06e48c683353433b9d1994ef6d386c5c2f04756c35d7653a037ac
Instruction ID: 7bc05c1a614cf0111fdcfd091bab25447c0822a5842d3af3157bbd2c428ad85a
Opcode Fuzzy Hash: 2bbe2c0954d06e48c683353433b9d1994ef6d386c5c2f04756c35d7653a037ac
Instruction Fuzzy Hash: 791158B28003598FCB60DF99C449BDEBBF4EB48320F10842AD558A7341D338A545CFA4

Function 0702DDAC Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0702E759,?,?), ref: 0702E900

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9b889766ca7720edcf13b07f5eb374bb047af0505cf52512b1af2fee14339f7e
Instruction ID: 0416529233dd46ad5f7679cfb55d4c62e23ed60f81418108c190d58078656b50
Opcode Fuzzy Hash: 9b889766ca7720edcf13b07f5eb374bb047af0505cf52512b1af2fee14339f7e
Instruction Fuzzy Hash: DF1155B28003498FCB60DF99C449BEEBBF4EB48320F20842AD558A7341D338A945CFA5

Function 0702DDB8 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0702E759,?,?), ref: 0702E900

Memory Dump Source

Source File: 00000009.00000002.1443128682.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7020000_mpTrle.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8aea9b3078b6bf86725190e7c94ebb1880129929ad3ed55c790d27612190f58c
Instruction ID: 9b4b6dcf898a730df53d4284398027355f9fc538822a2883e917fe7089f3f105
Opcode Fuzzy Hash: 8aea9b3078b6bf86725190e7c94ebb1880129929ad3ed55c790d27612190f58c
Instruction Fuzzy Hash: 971146B18003498FCB60DF99C449BDEBBF4EB48320F10842AD558A7241D338A545CFA5

Function 0137D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1439622946.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_137d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2063d836401107e8f2ee4607a89149653f280fa131d628b53a86b5d21576888d
Instruction ID: 2e6afa7260cc586035939ec5e2f8e8ef766a6f9dd85ad57f72fba9326c01bd86
Opcode Fuzzy Hash: 2063d836401107e8f2ee4607a89149653f280fa131d628b53a86b5d21576888d
Instruction Fuzzy Hash: EE21F171504204DFDB16DF98D9C0B26BF65FF88328F24C5A9E9091B25AC33AD417CBA1

Function 0138D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1439665273.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_138d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f500ab8d2c8c54cd04e4511657db82cf9abb6370add8f1ef35ee85a9d856e21
Instruction ID: 68cd40d635ea779c081093fd0cd9d58b289b7feed90f9397a4fd6910d449eff9
Opcode Fuzzy Hash: 3f500ab8d2c8c54cd04e4511657db82cf9abb6370add8f1ef35ee85a9d856e21
Instruction Fuzzy Hash: F12122B1604304DFDB15EF98D980B26BF65FB88318F20C56DE80A4B396C33AD407CA61

Function 0138D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1439665273.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_138d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecab22ef7d3669ceb6e1e997a14c2962a55b0eb29009f983e2664df65ea6d088
Instruction ID: 766f1e68b8fa551c2c62ed50840209a936b511707177ceb90173a1c430873776
Opcode Fuzzy Hash: ecab22ef7d3669ceb6e1e997a14c2962a55b0eb29009f983e2664df65ea6d088
Instruction Fuzzy Hash: 32210771504304DFDB05EF98D5C0F26BB65FB84328F20C56DE9094B296C336D406CA61

Function 0137D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1439622946.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_137d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e913fbe4a6093fe52002ebff3728cbe293fe76fa7d723964536c1d21f6342d
Instruction ID: ffc20e896743a6b15a7049d9d88e1aa70e226c0d3cf4e7f4dcae69de406a5e86
Opcode Fuzzy Hash: 21e913fbe4a6093fe52002ebff3728cbe293fe76fa7d723964536c1d21f6342d
Instruction Fuzzy Hash: B7219D76504244DFDB16CF54D9C4B16BF62FF84324F24C5A9ED090A656C33AD42ACBA1

Function 0138D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1439665273.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_138d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: b03a63c9dfcaf15cdef406a74846a3f3fa8bb3973073822319879d885bf2db8a
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 8C11BB75504384DFDB02DF58C5C4B15BBB1FB84328F24C6A9D8494B296C33AD40ACB61

Function 0138D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1439665273.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_138d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 8569ce95e63f69de272814c2be84854a01624dd0faba2e91969af8305f7bc6b3
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 1E11BBB5504384CFDB12DF58D5C4B15BBA2FB84318F24C6AAD8494B696C33AD40BCBA2

Analysis Process: mpTrle.exePID: 8160, Parent PID: 8116COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	87
Total number of Limit Nodes:	11

Executed Functions

Function 069D3490 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 069D3BDC
$_q, xrefs: 069D3BE8
$_q, xrefs: 069D3BC4
$_q, xrefs: 069D3BB8
$_q, xrefs: 069D3B8F
$_q, xrefs: 069D3B9B

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: f282e12820b17fdc9566b6d0f437b90f90fb8cbf3395abd8da49cddcc0d1bbce
Instruction ID: 0b89a420f2d4f13c0919fe9723a26c4b5eb135bcaf3677bc3ada6c86532278ee
Opcode Fuzzy Hash: f282e12820b17fdc9566b6d0f437b90f90fb8cbf3395abd8da49cddcc0d1bbce
Instruction Fuzzy Hash: 6C322130E1061ACFCB14EF75D8546ADB7B6BFC9301F20CA69D409A7264EF709985CB91

Function 069D7D70 Relevance: 3.0, Strings: 2, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 069D8317
$_q, xrefs: 069D830B

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: 786681332b73ac815e149cccff5730931543b3bb317136f4cb62a475b0209d77
Instruction ID: a962b003fc9d0b2fe0115d86d9632597870820f9057d1b17b9d7514924c6f496
Opcode Fuzzy Hash: 786681332b73ac815e149cccff5730931543b3bb317136f4cb62a475b0209d77
Instruction Fuzzy Hash: 9C02A930B002168FDB54DB69DA90AAEB7E6FF84344F24C938D4099B795DB31EC46CB90

Function 069D65E8 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c50107f28e94ca0b5ff3701ee7b2751a3db7f0af74661eff77e10942dd19a66
Instruction ID: 5532007a8ea59688530b80ac7d7ebbcfbf8615f5ec148207b732ee64b58e67a5
Opcode Fuzzy Hash: 5c50107f28e94ca0b5ff3701ee7b2751a3db7f0af74661eff77e10942dd19a66
Instruction Fuzzy Hash: B262A934A002059FDB54DB68D594AADBBF6EF88314F20C579E40AEB794DB35EC46CB80

Function 069DC178 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861e32039ccebd9415764ada49ed0d768f3e747dfd2f969c629cda8c6998af58
Instruction ID: c82e49cb65c56ac81ebb99caa7acc07516978dabde15c86a903854ca57e50184
Opcode Fuzzy Hash: 861e32039ccebd9415764ada49ed0d768f3e747dfd2f969c629cda8c6998af58
Instruction Fuzzy Hash: 66328930B002199FDB54DF69D990AADB7AAFB88310F208539E505EB759DB31EC42CB91

Function 069D55D0 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb67d7fa1a50abf1fc640b9d4f7a8feddc0935be1b1a362683f87f73bfb557f
Instruction ID: 964c2fa6d320af9619b7608041ebc2d183b0a143e5e24f6bedcb54697b524b13
Opcode Fuzzy Hash: ddb67d7fa1a50abf1fc640b9d4f7a8feddc0935be1b1a362683f87f73bfb557f
Instruction Fuzzy Hash: CF12EE75F002059BDF64DB64C8806AEBBBAEB84310F35C879D85ADB785CA34DC46CB91

Function 069DB220 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bc5254121679314430fe3f1053d3c8f01082b75f33baca9829187c276bdf76
Instruction ID: 730b8108a3c48eb32199ac9108f88cee168e579a1301803ef996c946360356e2
Opcode Fuzzy Hash: f2bc5254121679314430fe3f1053d3c8f01082b75f33baca9829187c276bdf76
Instruction Fuzzy Hash: 5F2270B0E002099FDF64CB69C4907ADBBAAEB45314F21C939E409DBB59CA34DC85CB51

Function 069DACC8 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 069DAEA0
$_q, xrefs: 069DAE48
$_q, xrefs: 069DAE6B
$_q, xrefs: 069DAE77
$_q, xrefs: 069DAE94
$_q, xrefs: 069DADE9
$_q, xrefs: 069DAE3C
$_q, xrefs: 069DADF5

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: 6aadfd88c07c0ed8be3656e24439bc055f80440c644a066580dbafef5572df94
Instruction ID: 1e44c558b9eb34b413f131886dd4f2d193698af912f3d4858bac435b032816db
Opcode Fuzzy Hash: 6aadfd88c07c0ed8be3656e24439bc055f80440c644a066580dbafef5572df94
Instruction Fuzzy Hash: 4AE15D30E1021A8FDB54DF69D8906AEB7B6FF85304F208539E809EB758DB719C46CB91

Function 069DB648 Relevance: 8.0, Strings: 6, Instructions: 473COMMON

Download Yara Rule

Strings

$_q, xrefs: 069DBB9D
$_q, xrefs: 069DBB91
$_q, xrefs: 069DBBF9
$_q, xrefs: 069DBBC5
$_q, xrefs: 069DBC05
$_q, xrefs: 069DBBD1

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: b68db8f69bf4d377aadfa83632ff47d1c54e4c2a6970379ba205f9ed033f1338
Instruction ID: af746944177ff85810244a16d1869f47634310bc68d0ef940012cfc3982ca9f3
Opcode Fuzzy Hash: b68db8f69bf4d377aadfa83632ff47d1c54e4c2a6970379ba205f9ed033f1338
Instruction Fuzzy Hash: D3027BB0E0020A9FDFA4CF69C480AADB7A6FB45314F21C97AE405DBB59DB34D845CB91

Function 069B308B Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 069B310E
GetCurrentThread.KERNEL32 ref: 069B314B
GetCurrentProcess.KERNEL32 ref: 069B3188
GetCurrentThreadId.KERNEL32 ref: 069B31E1

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0dab675fed51dd72108bc9fb68cff73e83b15b94fe5ba4f1315fe1d1d8308422
Instruction ID: 496ade3103d1158a3f0ccc2f5a7ffc982c007235fef78f1e964e5869f91d09b7
Opcode Fuzzy Hash: 0dab675fed51dd72108bc9fb68cff73e83b15b94fe5ba4f1315fe1d1d8308422
Instruction Fuzzy Hash: A85165B09003098FDB94DFAADA48BDEBBF5AF48310F248459E019A7760D7345944CBA5

Function 069B3090 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 069B310E
GetCurrentThread.KERNEL32 ref: 069B314B
GetCurrentProcess.KERNEL32 ref: 069B3188
GetCurrentThreadId.KERNEL32 ref: 069B31E1

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ff158150292190ff9e3fbc40f475cb9656faff1ec678a32e46d9375ac9a23787
Instruction ID: 7dd04ecce82c121be7b123222901ff1148814454eb57b9f39f9852435d9df6df
Opcode Fuzzy Hash: ff158150292190ff9e3fbc40f475cb9656faff1ec678a32e46d9375ac9a23787
Instruction Fuzzy Hash: 5A5165B0D003098FDB94DFAADA48BEEBBF5AF48314F248459E019A7760D7345944CFA5

Function 069D9148 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 069D919B
$_q, xrefs: 069D91D6
$_q, xrefs: 069D918F
$_q, xrefs: 069D91CA

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 744eb1521b23e740b106301ec91b83dedb0173f13f7d7bc6a567cc4add277d19
Instruction ID: f2f09dafc7e37610f95b5ea399298fa3e12eee3ab0f300dad47025628fccf4fe
Opcode Fuzzy Hash: 744eb1521b23e740b106301ec91b83dedb0173f13f7d7bc6a567cc4add277d19
Instruction Fuzzy Hash: 18916D30B0021A9FDB54EF65D9507AEB7FABF88200F108579D809EB758EB319D46CB91

Function 069DCF38 Relevance: 4.6, Strings: 3, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 069DD343
$_q, xrefs: 069DD32F
$_q, xrefs: 069DD337

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q
API String ID: 0-2441406858
Opcode ID: 5c9b09013f121bf0e14ac229cdcb4c81e7198859b0e42351cd6c4c2163f91930
Instruction ID: 459438348506b0b4ff5d3c3dfbb2e2bc1d353dade133dee25b49010e32d0e13d
Opcode Fuzzy Hash: 5c9b09013f121bf0e14ac229cdcb4c81e7198859b0e42351cd6c4c2163f91930
Instruction Fuzzy Hash: E2622E30A002169FCB55EF69D590A5DB7E6FF84314B20CA68E0099F76DDB71EC4ACB90

Function 069D4B98 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPdq, xrefs: 069D4CC5
\Odq, xrefs: 069D4D4F
fdq, xrefs: 069D52A5

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: fdq$XPdq$\Odq
API String ID: 0-727959394
Opcode ID: 470b4dbdec0cc3cac126ef491e15f5748078d95ed943b6fb9536631c4b678390
Instruction ID: 3db7b028c91848285567b0d38faa238b86ab5e848c9edd691fb40ab1fba169e3
Opcode Fuzzy Hash: 470b4dbdec0cc3cac126ef491e15f5748078d95ed943b6fb9536631c4b678390
Instruction Fuzzy Hash: 71619170F002199FEB54DFA5C858BAEBBF6FB88700F20852AE105EB395DB754C458B91

Function 069DA39A Relevance: 2.7, Strings: 2, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X!@, xrefs: 069DA54E
x!@, xrefs: 069DA56F

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: X!@$x!@
API String ID: 0-2527372166
Opcode ID: 93034f3cf1c71629c71eae420a7e420bc10418ab3e0d7f951a6636c138c76ef3
Instruction ID: 0f5a0b51d8e5ffc9109a5e63c0dcbb1fc2404d7306d5b1a09ac3b549a6b3dfb1
Opcode Fuzzy Hash: 93034f3cf1c71629c71eae420a7e420bc10418ab3e0d7f951a6636c138c76ef3
Instruction Fuzzy Hash: 7B81A031F002159FCB54EBA9E854AADB7B6FF88310F208939E509EB754DB31AC55CB90

Function 069D9139 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 069D918F
$_q, xrefs: 069D91CA

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: c03ea9478632c448b265f1bb613dfa1d2446a7d2eb3253d9be3bf268ab79f865
Instruction ID: 88b7c4caaeea0149017c0458f4598bbe6629592f083875cbdb507c2e27e0904e
Opcode Fuzzy Hash: c03ea9478632c448b265f1bb613dfa1d2446a7d2eb3253d9be3bf268ab79f865
Instruction Fuzzy Hash: 1D516030B001169FDB54EF75D950BAEB7FAAF88650F108539D809EB798EA31DC42CB91

Function 069BB710 Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 069BB976

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 49135a9ac8077bd57cfd9d1b14768c7dcfcb40586da111a3e75fbb3987bdba14
Instruction ID: cfd2c4a7235959182fc16fa309e2d92181ae7d1d5b6a7f9e57f02972438f7462
Opcode Fuzzy Hash: 49135a9ac8077bd57cfd9d1b14768c7dcfcb40586da111a3e75fbb3987bdba14
Instruction Fuzzy Hash: 3F817970A00B058FD7A4DF6AD54579ABBF5FF88300F108A2DE48AD7A84DB74E805CB91

Function 069BD8E4 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069BDA02

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8276e11d8441e26876f351074901f37161acf8895b9ec7d1b6320565628f5372
Instruction ID: 0c7fb17ccd1578d29267a67f8f828932bd0ae691088501cc62ebbf804244314f
Opcode Fuzzy Hash: 8276e11d8441e26876f351074901f37161acf8895b9ec7d1b6320565628f5372
Instruction Fuzzy Hash: 5651D1B1D003499FDB14CF99C984ADEBFB5BF89310F64912AE819AB210D7719885CF90

Function 069BD8F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069BDA02

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 79ccc07c1f43af6c8b9bfaa68ad632a4d07832fc42b03b2d0ba604f9f56d28a1
Instruction ID: 037fc17a6cf6846deba9b4a895f0987c0e6b74cd5a70d0b70071847b108dca15
Opcode Fuzzy Hash: 79ccc07c1f43af6c8b9bfaa68ad632a4d07832fc42b03b2d0ba604f9f56d28a1
Instruction Fuzzy Hash: CD41B0B1D00349DFDB14CF9AC984ADEBBB5BF88310F24912AE819AB210D7759985CF90

Function 02C2F018 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02C2F0BF

Memory Dump Source

Source File: 0000000A.00000002.1524435509.0000000002C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c20000_mpTrle.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d07775b4c4952f64fdd5d10540933b20ccf5003cdabad177dcc496b13bfc8b7a
Instruction ID: 3921577e62145d470dfab610359a857e76508739201b64d37bd7b9cfc8579222
Opcode Fuzzy Hash: d07775b4c4952f64fdd5d10540933b20ccf5003cdabad177dcc496b13bfc8b7a
Instruction Fuzzy Hash: AE2189B1C0425A9FCB14DFAAC80479EFFF4AF48320F11846AE808A7241D7789945CFE1

Function 069B32D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069B335F

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8c68170f4c9f15e3a2fd7a775c228fe14882ad8bd8e4ed5da9fa22d242e71f86
Instruction ID: fa7e15e61a1241231fbbf6bab71fca9c8bd0046150012f1759fce5de41196f2b
Opcode Fuzzy Hash: 8c68170f4c9f15e3a2fd7a775c228fe14882ad8bd8e4ed5da9fa22d242e71f86
Instruction Fuzzy Hash: 1121E4B5D002089FDB10DFAAD984ADEBBF5FB48310F14841AE919A7350D378A954CFA0

Function 069B32D8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069B335F

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e852c1fa5911ee921279139f24cec81f343a9c716b45020dbd51243c9ad51228
Instruction ID: ecc6b77bf8a2db1fbf5b5e911d6293fd3fc41cf7a4524e54b65907daf3a82aea
Opcode Fuzzy Hash: e852c1fa5911ee921279139f24cec81f343a9c716b45020dbd51243c9ad51228
Instruction Fuzzy Hash: D621C4B5D00248AFDB50CFAAD984ADEBBF8FB48310F14841AE918A3350D375A954CFA5

Function 02C2F058 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02C2F0BF

Memory Dump Source

Source File: 0000000A.00000002.1524435509.0000000002C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c20000_mpTrle.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 52291b6c33a0781a9ddaeb08c27b815fa0ba88912612edc78dc557cdcdafd543
Instruction ID: 5788e465862901437a522b6b40634f31bf8c8dec773819f8a8f8c03e246c164b
Opcode Fuzzy Hash: 52291b6c33a0781a9ddaeb08c27b815fa0ba88912612edc78dc557cdcdafd543
Instruction Fuzzy Hash: 8011E2B1C006599BCB10DF9AC544BDEFBF4AB48320F15816AD818B7640D779A944CFE5

Function 069BB910 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 069BB976

Memory Dump Source

Source File: 0000000A.00000002.1533730458.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69b0000_mpTrle.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a57004b46f038c20665dd793590d4ab414690a218c3db8a84b6c7864bd859e41
Instruction ID: 96022c472ca04b2e2e532df6113fdb4d167b81cf0e7104027655b0430f1c14b7
Opcode Fuzzy Hash: a57004b46f038c20665dd793590d4ab414690a218c3db8a84b6c7864bd859e41
Instruction Fuzzy Hash: E71110B6C003498FCB10DF9AC944ADEFBF8AB88314F10841AD829B7650C379A545CFA1

Function 069D4B88 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPdq, xrefs: 069D4CC5

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: XPdq
API String ID: 0-1708276200
Opcode ID: ccfbeae714151d8b31792ffbe37befc81661b1688cb28957ecb33d2b62c1e5f1
Instruction ID: 6665649a947e57981a79a1de85a020e2068a63a2e46c064e3f4883d13f67a609
Opcode Fuzzy Hash: ccfbeae714151d8b31792ffbe37befc81661b1688cb28957ecb33d2b62c1e5f1
Instruction Fuzzy Hash: 9D414F74E002089FDB54DFA5C858BAEBBF6BF88700F20C529E145AB395DA755C05CB91

Function 069DDAAD Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH_q, xrefs: 069DDC09

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: bee863479f2330c94c00e5a645285a597f49f7edde63e67c44778fa38e0372c9
Instruction ID: 77e4b56c74c6342c8f8c438f84616349a2a558e08ccd53f6c531bc142cf3572f
Opcode Fuzzy Hash: bee863479f2330c94c00e5a645285a597f49f7edde63e67c44778fa38e0372c9
Instruction Fuzzy Hash: FC41C230E0020A9FDB64DF79C45069EBBB6FF85344F208939E405EB644DB74D84ACB81

Function 069D21E5 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH_q, xrefs: 069D2333

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 314ec3f3cc4482282df655fd671ee077140ade86fe72481a0c3f6a1ed7638b7e
Instruction ID: 42529c8e568e363f6d93d0d9284820407c81523640da2dfa80322ba304ce0cc7
Opcode Fuzzy Hash: 314ec3f3cc4482282df655fd671ee077140ade86fe72481a0c3f6a1ed7638b7e
Instruction Fuzzy Hash: 58310030B002028FDB599B75C46066F7BA6BF89744B208A78E506DB388DF35DE46C7A1

Function 069D21F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH_q, xrefs: 069D2333

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 0d70f9e5e83f2d76cc049089319d74cb9e20fd9c7ded6643e236e9944abac432
Instruction ID: 2da0e959cdad53c1a270532f9a9c81f1476e66d866c260614f9c22fb0d429405
Opcode Fuzzy Hash: 0d70f9e5e83f2d76cc049089319d74cb9e20fd9c7ded6643e236e9944abac432
Instruction Fuzzy Hash: F731DE30B002028FDB59AB74C51476F7BE6BB88644F208938E506DB398DE35DE46C7A1

Function 069D82C0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$_q, xrefs: 069D830B

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q
API String ID: 0-238743419
Opcode ID: 4a7f2f44f6dd31331060c7ad563d6a53a76f97b769152ea96c241f601b40254f
Instruction ID: eb6f5aaa7eb545d5fa51785749c2af4d5d5ee5744ecf75ce8c6b7918234fdad9
Opcode Fuzzy Hash: 4a7f2f44f6dd31331060c7ad563d6a53a76f97b769152ea96c241f601b40254f
Instruction Fuzzy Hash: 91F0FF31A002128FDF689E96FB80AACF7A9EB40340F248535DA09CBA46C632ED01C740

Function 069D61E8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4d811316ee7af5ad6935e658549296b263bcb5287d89a17ecea4563381286f
Instruction ID: 6ce7b303ecbc4c54d4dd219334fe92633d3fc0e5c98446f9d30dd0d6259eb4e8
Opcode Fuzzy Hash: ec4d811316ee7af5ad6935e658549296b263bcb5287d89a17ecea4563381286f
Instruction Fuzzy Hash: 5D618EB1F400214FDB549A6EC88066FBADBAFD4224F258439D90EDB364DEA5DD0287C1

Function 069D42C9 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d61be176ca65081a7e8a908560fe07429ce029e2aa586babd875377b9c7b27a
Instruction ID: 3fc199beff87a9ed7797258ca3522599bc15140c9168ebbcbeec2e9e80b1a74f
Opcode Fuzzy Hash: 4d61be176ca65081a7e8a908560fe07429ce029e2aa586babd875377b9c7b27a
Instruction Fuzzy Hash: 9A814C30B0020A8FDB54DFB9D55069EB7F6AF88704F208539D40AEB798EB74DC468B91

Function 069D45E8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 727f5bc8e5571b20efacbacf0a0ae24295da986549199c1e6cfd063f9cf85cb5
Instruction ID: b26a60ba767b815285d9ce12c61262a6610134174d419f728dacfd1372e767d4
Opcode Fuzzy Hash: 727f5bc8e5571b20efacbacf0a0ae24295da986549199c1e6cfd063f9cf85cb5
Instruction Fuzzy Hash: 45914E34E102598FDF60DF68C890B9DBBB1FF85300F2085A9D549BB295DB70AA85CF91

Function 069D4600 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbcf3b6e24a40fdad67a9b3cb889f77efc0c523569e23c87243ed82106f35bf0
Instruction ID: 0f8ccaa510676dd3ac3162afb726663b8baa45a34ce0850e98b98b1e20a55f07
Opcode Fuzzy Hash: bbcf3b6e24a40fdad67a9b3cb889f77efc0c523569e23c87243ed82106f35bf0
Instruction Fuzzy Hash: 73913C34E1021A8BDF64DF68C880B9DB7B1FF89310F20C5A9D549BB255DB70AA85CF91

Function 069DEF00 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d801b4dd26192d46f758b0a7d4aa1c70a032efb9f2b2213c12bcd638bb62fb
Instruction ID: 1d5ce581995f862db3976d287925949f1c70facaa104fe0ff5cb0b9d65017c0e
Opcode Fuzzy Hash: 59d801b4dd26192d46f758b0a7d4aa1c70a032efb9f2b2213c12bcd638bb62fb
Instruction Fuzzy Hash: A3712A70A002199FDB54DFA9D990A9DBBF6FF88300F24C539E40AEB655DB30E946CB50

Function 069DEF10 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9a5105b3a2a99af878f0e03edeeaf19c28f623bf8aad537c057d9cd6caab56
Instruction ID: 90366afb45787cc8d339bc07223504c4dd8152c23f3f2e20fdc402feedd6cad2
Opcode Fuzzy Hash: 6d9a5105b3a2a99af878f0e03edeeaf19c28f623bf8aad537c057d9cd6caab56
Instruction Fuzzy Hash: 5B711970A002099FDB54DFA9D990A9DBBF6BF84300F24C539E41AEB754DB30AD46CB50

Function 069DFC70 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c0057ad85a3f8e1d9f6166b015e562437f14a203fe0a6492a56cb3b8594ee6
Instruction ID: d78048df19183f32699a78a9e7ed131620c9096613e9a4fd11a0b08585a1db26
Opcode Fuzzy Hash: 74c0057ad85a3f8e1d9f6166b015e562437f14a203fe0a6492a56cb3b8594ee6
Instruction Fuzzy Hash: 0F510031E00105DFCF24EB78E8596ADBBB6FB88315F20887AE10ADB655DB319845CB91

Function 069DFA1F Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281235fad8e46332592bfd661c3fbb824e766f1026eba4db62d4c780fa2c4c2f
Instruction ID: 79e7039e2e1c15a8c3a4e94d2d8d5bc4cef46b9237c45c6f4419d5dcfd668edb
Opcode Fuzzy Hash: 281235fad8e46332592bfd661c3fbb824e766f1026eba4db62d4c780fa2c4c2f
Instruction Fuzzy Hash: FA51D830B102159BEF645A78D96576F2A5ED789310F30853AF40FC77D9CA69CC4583E2

Function 069DFA30 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbb96730fcef0c103978523ac17da1b5a74c7b045899c13130ab38aa8e1076b
Instruction ID: 649164684fdaa93c76df1d2003afda2b170711a546023c4abdfa54e2f15ab469
Opcode Fuzzy Hash: 0cbb96730fcef0c103978523ac17da1b5a74c7b045899c13130ab38aa8e1076b
Instruction Fuzzy Hash: 6951D330B202159BEF646A6CD96572F265ED789310F30893AF40FC77D9CA69CC4543E2

Function 069D5440 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a502739b503ca14450004ecc4bd8255bced6a7d6bb4e3fe40782e9c60cdd6770
Instruction ID: d9996db396a7bb3ec43539d95ad2860db562a385a83cb7430c985f209350e439
Opcode Fuzzy Hash: a502739b503ca14450004ecc4bd8255bced6a7d6bb4e3fe40782e9c60cdd6770
Instruction Fuzzy Hash: EA417171E006098FDB61CFA9D880AAFBBF6FB85310F21893AD155D7A54D330E8598B91

Function 069D55C1 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1439303f5f0960525c01734eccb746d409dd28bc40fcd9db567260382e78f76
Instruction ID: a6223fb3dffb4ea27801eb50120ba6862f94279a382f53894013e96bed54dd32
Opcode Fuzzy Hash: f1439303f5f0960525c01734eccb746d409dd28bc40fcd9db567260382e78f76
Instruction Fuzzy Hash: 8B318F30E002059BDF708E69C88077EBBBAFB85220F71C93AD459DBA85C635D941CB91

Function 069DD960 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3f9d44a01519fa971e38153af7a7e8a0eb1a9f187760c99919d3b163541935
Instruction ID: b01d32a45d52470e84a5fea942293f25838f93bc7e057504958e0dc61ca76e50
Opcode Fuzzy Hash: db3f9d44a01519fa971e38153af7a7e8a0eb1a9f187760c99919d3b163541935
Instruction Fuzzy Hash: 2B31D630E1060A9FCF14DF65C850A9EBBBAFF85304F108939E405EB704DB71A8468B91

Function 069D20A8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3b6a5f99e7b260b2c98f2121e5ef081b6f1efd827cc6618aad42080f95f2c9
Instruction ID: 1984fb0c57fddfc59770cdd9205562987c20cbac0dda8a46b86db91c9253ac76
Opcode Fuzzy Hash: ea3b6a5f99e7b260b2c98f2121e5ef081b6f1efd827cc6618aad42080f95f2c9
Instruction Fuzzy Hash: 34318E30E1020ADBCB54CF65C854A9EB7B6FF89310F10C529EA16EB754DB31AD46CB80

Function 069D20B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e9a552da04ac54d36e5a7bc8ca3e2fef31f3968f477df988ef302ea674c59e
Instruction ID: 5669d82121cab73020735d3ba715654f6b16ac80cc7ad7fc287795ddea240cb4
Opcode Fuzzy Hash: 04e9a552da04ac54d36e5a7bc8ca3e2fef31f3968f477df988ef302ea674c59e
Instruction Fuzzy Hash: 6A318030E1020A9BCB54CF65D854A9EB7F6FF89310F20C529EA16E7754DB71AD42CB90

Function 069D3ED1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e8af2bc61d46c0964e989a2740048af0f2060b91c2acc71023074f8369c947
Instruction ID: c390edfb727b3daf3bdf864b5c9e17efd05abf5735aca7065fc65d166718fbdf
Opcode Fuzzy Hash: f3e8af2bc61d46c0964e989a2740048af0f2060b91c2acc71023074f8369c947
Instruction Fuzzy Hash: 46217A75F002199FEB40DFB9D881AAEBBF6AB48310F108135E945E7394E731DC018BA1

Function 069D3EE0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7876bffe8a1ac34faab9c21a653be92bc8db8075ee6b1b7f6bf27a969394da
Instruction ID: 9f3f74c3c0f08fce1b728ff00b44555079b80abeb11304a3be5ace2504ce97f2
Opcode Fuzzy Hash: 5f7876bffe8a1ac34faab9c21a653be92bc8db8075ee6b1b7f6bf27a969394da
Instruction Fuzzy Hash: 8D218C75F002199FEB50DF6AD880AAEBBF6EB48710F208139E905E7394E770DC018B91

Function 069D3481 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e9c52a23d8d6811084862a92c9b992f32ecdd8406cd66b5799f1dd06ab57a1
Instruction ID: 9606aa5028ccd5fbf4e2cbda1617558d23ca968d14b2aba4d66dc1b7f7164b87
Opcode Fuzzy Hash: 99e9c52a23d8d6811084862a92c9b992f32ecdd8406cd66b5799f1dd06ab57a1
Instruction Fuzzy Hash: 2B21C270E001299ECB54DB69D8405DEB7B5EB86311F10C979E40AE7700DA31D941CBA2

Function 010FD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1522818552.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10fd000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e337526afce01dc32bbc71f29f6dc9802350b235c0c048af53447f09af20ae6d
Instruction ID: 1bcd282b2559fbfb4cbe542dacf9e5e8111c76aa2378279fd887c5ce6d238e4d
Opcode Fuzzy Hash: e337526afce01dc32bbc71f29f6dc9802350b235c0c048af53447f09af20ae6d
Instruction Fuzzy Hash: D6213471504204EFCB11CFA8C9C1B26BBA5FB84314F20C5ADFA894B756C73AD446CB62

Function 069D6D08 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78339a5988a724034f483e2cd67a43d6b3ea2a50ed61527eb1b9e979feb2ba9
Instruction ID: 7354bd2c84a6dc8c0e96a9eb1eb21e9a1fcf930008699d21f0647c9ab185ee15
Opcode Fuzzy Hash: f78339a5988a724034f483e2cd67a43d6b3ea2a50ed61527eb1b9e979feb2ba9
Instruction Fuzzy Hash: 83219D30B101199FDB44DB69E854BAEB7B6FB84350F208535E505EB784DB31AC458B80

Function 069D4229 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cdc14dab6ee9ec90c877035940b373714004691406b3f9fc56e5f0f709417a
Instruction ID: d33d72fed3d7c7921286c352e863bb6b3f66082173d9c4c65e4c6b4c0f6e2d19
Opcode Fuzzy Hash: f2cdc14dab6ee9ec90c877035940b373714004691406b3f9fc56e5f0f709417a
Instruction Fuzzy Hash: 7401D634B005241FC75586AD9810B9BBBDADBC9A24F20C43AE609C7759D931CC0343D1

Function 069D3FF0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34560627455af117a9d1b76602c225f9decb3cc32081d04c89b7648db9069900
Instruction ID: 602f66cbd5063f84b0a809cb8fac662beaee8d734115f84bdc8fea617ae7174b
Opcode Fuzzy Hash: 34560627455af117a9d1b76602c225f9decb3cc32081d04c89b7648db9069900
Instruction Fuzzy Hash: 2C11A131B100298BDB48DA78D810AAE73EAEBC8751F108539C50AE7344EE75DC028B91

Function 069DF17F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e5062f1a565b271f857187c1cf4663cf2841ebf67b221f361de9f36479fe93
Instruction ID: 19e0a6573fbb2de4b4cef11b124d3c7affc10403cc6ba6907b6893c77f35340b
Opcode Fuzzy Hash: b8e5062f1a565b271f857187c1cf4663cf2841ebf67b221f361de9f36479fe93
Instruction Fuzzy Hash: 1901B5357005151FCB619A799855B6F7BDADB85710F24C435F60BCB345D910CD024391

Function 069D3FDF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88580bfeeebe5932a89d673be4e617207c3cffcea85cbf148368ef8b01acbb5d
Instruction ID: 0ceda36c95de63ffdb30925d30abe9b01f6c60494524a7f5e23db5c3107f582c
Opcode Fuzzy Hash: 88580bfeeebe5932a89d673be4e617207c3cffcea85cbf148368ef8b01acbb5d
Instruction Fuzzy Hash: 7801C032F100255BEB549A69DC106EF77AAEBC9A50F148535D506E7284EE21980687E1

Function 069D3CA8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56290975f0526e337dda09c2fd87d243787cddad4dc3c318bc84035b3a2563f8
Instruction ID: d1ee7f69761da08694a9ce5c211e4bd33805f337d929ce2c2624ff8edf804159
Opcode Fuzzy Hash: 56290975f0526e337dda09c2fd87d243787cddad4dc3c318bc84035b3a2563f8
Instruction Fuzzy Hash: 462100B5C05259AFCB40DF9AD884ACEFFB8FB49310F10812AE918B3600C375A954CFA5

Function 010FD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1522818552.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10fd000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 6b7c4b74fc02b85ec0b3ad15817c6afe398ac087591e0d58d3b65dad61ee5b59
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 6F11DD75504284DFDB12CF54C9C4B15BFA2FB84314F24C6ADEA894B652C33AD44ACF62

Function 069DA2F8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd121eedf689867f18e1b88ab1c484c0f1102f89605d2198c4c0eccc6cf5d51
Instruction ID: fe926f7c7198b8424d7d1e34ac5f83a6011c9ebc60e8f1f4385819d9fa41ac85
Opcode Fuzzy Hash: 7fd121eedf689867f18e1b88ab1c484c0f1102f89605d2198c4c0eccc6cf5d51
Instruction Fuzzy Hash: F9012830B041165FC711EB7DD820B1EFBDAEB46760F14C538E10AC7355EA21DC018381

Function 069D3CB0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe2e365d90ca12de80a4712431924d6767607825342e1c6fed977161087b1c6
Instruction ID: 683d407a30bcfb80270fad08ea24e22581152e2fc87986cb1852c7e858ff6025
Opcode Fuzzy Hash: cfe2e365d90ca12de80a4712431924d6767607825342e1c6fed977161087b1c6
Instruction Fuzzy Hash: 8A11DDB5D01259AFCB00DF9AD884ACEFFB8FB49310F10812AE918B7200C375A954CFA5

Function 069D4238 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bc8b0e00505ae1dd7d07243048b0cedd7045a47f90b47918b4fe8603199b44
Instruction ID: 8f7c1d19ed0c69fed7f0dd4d0d5f16a95cec42ee9d016bf9267e4df43352c030
Opcode Fuzzy Hash: 61bc8b0e00505ae1dd7d07243048b0cedd7045a47f90b47918b4fe8603199b44
Instruction Fuzzy Hash: BB01AD30B004150BDBA496AD9464B6BA3DBDBC8B24F20C43AE60EC7759EE71DC0243D1

Function 069DF190 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca94354b0ec0b553c3cac4f4f4935d205445fdcf211783d762fcfa4065b5c24d
Instruction ID: aac04b3907493d08f85101d61defb9d8195d8158017ac4bee9dea8880492a2ce
Opcode Fuzzy Hash: ca94354b0ec0b553c3cac4f4f4935d205445fdcf211783d762fcfa4065b5c24d
Instruction Fuzzy Hash: 06018C36B004150BCBA4DA7DE895B2FA7DAEBC9720F24C839E60BC7344EE61DC024391

Function 069DA308 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf064783086dabfbe5874501f031e8a4eab6c135d804d1cc7b474ca646b288ee
Instruction ID: beaf44e973ff002822cf5cfcd199ecdafa2394231dd756b24f241f074c20adf1
Opcode Fuzzy Hash: cf064783086dabfbe5874501f031e8a4eab6c135d804d1cc7b474ca646b288ee
Instruction Fuzzy Hash: 00018130B001164FCB50EA7DD454B2EB3DBEB85760F20C938E10AC7354EA22DC528780

Function 069DC7D0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3554d301425d280304ef25cf3152fff95c362c605dc830b7a1369f4bc2c250b9
Instruction ID: 1506c935210f74e880ddd6ebe0d4a9741a5108a48745f6c93396dc8ea91dada8
Opcode Fuzzy Hash: 3554d301425d280304ef25cf3152fff95c362c605dc830b7a1369f4bc2c250b9
Instruction Fuzzy Hash: CF01A431E202249BCB549A6AE851A9EB77EFB85314F108539E901EB745DB31A804CBC0

Function 069D6468 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66a7b41237a11844c403f36e5a57a0e3dd530384fa44b108bb8ac5728a56a68
Instruction ID: 39ad4fde42e2df618539cdf879bdbd10e6472fce2d6686deb51374ffe8e851df
Opcode Fuzzy Hash: b66a7b41237a11844c403f36e5a57a0e3dd530384fa44b108bb8ac5728a56a68
Instruction Fuzzy Hash: 0AE09270E05148ABDF50CFA1CA55B9E376DEB02208F20C8BAD408CB642E172DA1587C1

Function 069DFED9 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637969d9f086848d2a6bed3176bad35fbfc2c10ee5470b17bee6028dbfa23b83
Instruction ID: 7bf2b19196c20231882bdde26aca804edf3937ef0c634fa3ccaf45b048ac5723
Opcode Fuzzy Hash: 637969d9f086848d2a6bed3176bad35fbfc2c10ee5470b17bee6028dbfa23b83
Instruction Fuzzy Hash: 20B09B351015009F8F45EA3095805D13367FB863057D0189CF4110E6458735D413D551

Non-executed Functions

Function 069D7690 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$_q, xrefs: 069D7B3D
$_q, xrefs: 069D7BF2
$_q, xrefs: 069D7780
$_q, xrefs: 069D7BE8
$_q, xrefs: 069D7BDC
$_q, xrefs: 069D7B49
$_q, xrefs: 069D77B1
$_q, xrefs: 069D778C
$_q, xrefs: 069D7BFE
$_q, xrefs: 069D77BD

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-698649689
Opcode ID: 5bd7f9b649673e8bff381630d000c98bf5647172e973acf17ed37225acc49972
Instruction ID: 68fff2c07c9687817db615a5752415d058d5cfaa08a2dd3c558ff9be5ddf94ca
Opcode Fuzzy Hash: 5bd7f9b649673e8bff381630d000c98bf5647172e973acf17ed37225acc49972
Instruction Fuzzy Hash: BB120A30E002198FDB64DFA5C954AADB7F6BF89304F208979D409AB764DB709D85CF81

Function 069DA930 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$_q, xrefs: 069DAAEE
$_q, xrefs: 069DAA26
$_q, xrefs: 069DAA32
$_q, xrefs: 069DAA8D
$_q, xrefs: 069DAAAC
$_q, xrefs: 069DAA81
$_q, xrefs: 069DAAB8
$_q, xrefs: 069DAAE2

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: 629a4be7ac558108d086c102e2c31aa098dc498332d98fc7052329006966fb9a
Instruction ID: 75167f57c52eaa035dc34862a9a45741accf54b702c37201cfa0c01e2e2e780f
Opcode Fuzzy Hash: 629a4be7ac558108d086c102e2c31aa098dc498332d98fc7052329006966fb9a
Instruction Fuzzy Hash: 20917F30A0021A9FDB68EF65D994B6E7BF6BF84310F24CA39E4019B794DB749C45CB90

Function 069D7090 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$_q, xrefs: 069D73CC
$_q, xrefs: 069D73D8
$_q, xrefs: 069D7598
$_q, xrefs: 069D75A4
.5wq, xrefs: 069D70EB
$_q, xrefs: 069D7372
$_q, xrefs: 069D752C

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: .5wq$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-3129995876
Opcode ID: 60e86316ca018f84cfa39b04ede0ffc0e00aee83d1d0d84d326aeedc29cfcecc
Instruction ID: eac4cc9cce7815cfa1a9e8b4f5b6f5821e004a1fd002f5c82431391d83f5d8b0
Opcode Fuzzy Hash: 60e86316ca018f84cfa39b04ede0ffc0e00aee83d1d0d84d326aeedc29cfcecc
Instruction Fuzzy Hash: 87F13B30B00219DFDB58EFA5D594A6EB7B7BF84300F248579D4069B7A8DB31AC46CB81

Function 069D83C8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$_q, xrefs: 069D8622
$_q, xrefs: 069D862E
$_q, xrefs: 069D8693
$_q, xrefs: 069D8687

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: cbecfb68ad8a2eec305c93041932277ebaca037ee3b1b88895ccbc30db3a8d83
Instruction ID: c77bf0f7ccedcd82bba421e627729831dc9a84a26cc69b7aae41c1b4d7002e7e
Opcode Fuzzy Hash: cbecfb68ad8a2eec305c93041932277ebaca037ee3b1b88895ccbc30db3a8d83
Instruction Fuzzy Hash: 83B15A30B002199FDB58EF65C6946AEB7B6BF84300F24C979D0059B759DB74DC86CB80

Function 069D87E0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$_q, xrefs: 069D886B
$_q, xrefs: 069D885F
LR_q, xrefs: 069D88D3
LR_q, xrefs: 069D8922

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: LR_q$LR_q$$_q$$_q
API String ID: 0-2912794808
Opcode ID: 6c6ffad3d526e20a60fd9b325d4675960efac4cde89a66c653f5c8fa84a9f52a
Instruction ID: 03474042cee0ad22079afc4acc12427b1c2eb92b9d0e3d559354ba44162ffd53
Opcode Fuzzy Hash: 6c6ffad3d526e20a60fd9b325d4675960efac4cde89a66c653f5c8fa84a9f52a
Instruction Fuzzy Hash: 8851D330B002029FCB58EF29D950A6EB7E6FF84300F10CA79E4159B76ADA31EC01CB81

Function 069DACBA Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$_q, xrefs: 069DAE6B
$_q, xrefs: 069DAE94
$_q, xrefs: 069DADE9
$_q, xrefs: 069DAE3C

Memory Dump Source

Source File: 0000000A.00000002.1533894328.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69d0000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 4b43b96b6f5e73b78f9936b2d1ca481b6ee396f6fbe3e2c2189e0d52e2a196c0
Instruction ID: f082b56c6abdfc8d2affc193f0b5aac053fa4159ee16d3fdf9db3ff3fb612064
Opcode Fuzzy Hash: 4b43b96b6f5e73b78f9936b2d1ca481b6ee396f6fbe3e2c2189e0d52e2a196c0
Instruction Fuzzy Hash: 8E51BF30A102159FDF64DF68D880AAEB7B6FB84310F20893AE805D7744DB31EC46CB91

Analysis Process: mpTrle.exePID: 6388, Parent PID: 2592COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	256
Total number of Limit Nodes:	13

Executed Functions

Function 052CAE04 Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 052CB046

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bd33e74f7138ed9df69292af65c1f1c5606b1a62766149b2cd7526d575846eed
Instruction ID: b2e7080c5614fde5e213c20be4fd669cbac4f08cce7ecc2a8dcf21d1000983ac
Opcode Fuzzy Hash: bd33e74f7138ed9df69292af65c1f1c5606b1a62766149b2cd7526d575846eed
Instruction Fuzzy Hash: 0AA18B71D1021ADFDB20CFA8C845BEEBBB2BF45304F1482A9E849A7240DB759985CF91

Function 052CAE10 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 052CB046

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ea4bf111182db255c8dde81f174b45db471d5c33be6842d1a114562d42bcbd0b
Instruction ID: 93a64cdc9a1e96a61050d1e144e6faf95418c6769c42f4386ead7c8f4cc57c02
Opcode Fuzzy Hash: ea4bf111182db255c8dde81f174b45db471d5c33be6842d1a114562d42bcbd0b
Instruction Fuzzy Hash: E9916B71D1021ADFDB20CFA8C845BEDBBB2BF49314F1482A9E809A7250DB759985CF91

Function 0263ADA8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0263AFFE

Memory Dump Source

Source File: 0000000C.00000002.1523347611.0000000002630000.00000040.00000800.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2630000_mpTrle.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9fe5061dcb6784cdc903b922045af3df8503a34489554c205ee8eed851036d4f
Instruction ID: ca5eecea1f72525d016a5094e9cc1ff52487c059c74901af1c81308f04d508bd
Opcode Fuzzy Hash: 9fe5061dcb6784cdc903b922045af3df8503a34489554c205ee8eed851036d4f
Instruction Fuzzy Hash: D0711170A00B058FD725DF6AD44476ABBF2FF88304F008A2ED48A97B50DB75E949DB91

Function 026344C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026359C9

Memory Dump Source

Source File: 0000000C.00000002.1523347611.0000000002630000.00000040.00000800.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2630000_mpTrle.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 18bd3820ec0da98da40a90803dff2b3033e043611d977bfeb286320bd8397b7f
Instruction ID: df6641426e54c4572861f81ca0f3b013f611f0f587d02f21d78673795f4302a5
Opcode Fuzzy Hash: 18bd3820ec0da98da40a90803dff2b3033e043611d977bfeb286320bd8397b7f
Instruction Fuzzy Hash: F34102B1C0071DCBDB24DFAAC884B9EBBF5BF48304F60806AD409AB255DB756949CF90

Function 0263590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026359C9

Memory Dump Source

Source File: 0000000C.00000002.1523347611.0000000002630000.00000040.00000800.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2630000_mpTrle.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0fbec2647d73176ae19468b26d0816e56ed691e41a14a8ece1015612cd6354b3
Instruction ID: 9cc8217ae79ecfb16612e1dcb208e81a7e66ce94bab5b198fe856de1df184ef5
Opcode Fuzzy Hash: 0fbec2647d73176ae19468b26d0816e56ed691e41a14a8ece1015612cd6354b3
Instruction Fuzzy Hash: 4B4102B1C0071DCBDB24DFAAC88479EBBF1BF48304F60806AD409AB254DB75694ACF90

Function 04C64040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04C64101

Memory Dump Source

Source File: 0000000C.00000002.1542329873.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4c60000_mpTrle.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6e0316d90288824822d8b729d74aec030cdbe3efaba10764f3d38824fd2c4b97
Instruction ID: 8f6c4d78bab364e4b78e0943b547b340eaf4ae250662ec0dcef1e8c806bfdb12
Opcode Fuzzy Hash: 6e0316d90288824822d8b729d74aec030cdbe3efaba10764f3d38824fd2c4b97
Instruction Fuzzy Hash: 3F414CB9900319DFDB14CF99C488AAABBF6FF88314F24C459D519AB321D334A940CFA4

Function 052CA950 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 052CA8F8

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5ab9c6fe2f7e5668d7baba1653ac6783bbf7c85bd1c8bbca78b04af612edf7d9
Instruction ID: be0a7347d1d7d2cc2d18a0f00a08c45806b59cdc1a8072d78d3efafe2e26752a
Opcode Fuzzy Hash: 5ab9c6fe2f7e5668d7baba1653ac6783bbf7c85bd1c8bbca78b04af612edf7d9
Instruction Fuzzy Hash: 9A3185728043498FDB20DFA9D8457DEFFF0AF89320F14886EC459A7281C779A545CBA1

Function 052CA780 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 052CA818

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5943c2d54873108c65f94e218cff3b140f4bc89a4746bb6fe119b405866ee97f
Instruction ID: 55adefd20c46a9e325542cd3e727ce3521f06cdaed9cb3d0762e9bb3c213e6d0
Opcode Fuzzy Hash: 5943c2d54873108c65f94e218cff3b140f4bc89a4746bb6fe119b405866ee97f
Instruction Fuzzy Hash: B021467690030D9FDB10DFA9C985BEEBBF5FF48310F10852AE919A7241C778A945CBA0

Function 052CA788 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 052CA818

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 02423387d38145f83eb7b52bb81bcbffb595423b6b95bbc7b0f516d58920d199
Instruction ID: bbbc1777c26dfa3c6be4d7d05b04f2c488025452d37f83373ffb170df93c18a8
Opcode Fuzzy Hash: 02423387d38145f83eb7b52bb81bcbffb595423b6b95bbc7b0f516d58920d199
Instruction Fuzzy Hash: FD2124B690034D9FCB10DFA9C985BEEBBF5FF48310F10852AE919A7241D7789945CBA0

Function 052CA870 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 052CA8F8

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3f79e6daa1b942026bd92233366caa4c126570255777dbde72ded19354a309e5
Instruction ID: d0e836da7fe0d7fdc5a65d5e14e0b3508a8f17e2d4e4d9a74144438e22669ee5
Opcode Fuzzy Hash: 3f79e6daa1b942026bd92233366caa4c126570255777dbde72ded19354a309e5
Instruction Fuzzy Hash: 652105B1D002599FDB10DFAAC881AEEBBF5FF48310F10842AE919A7240D7799955CBA1

Function 0263D27C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0263D656,?,?,?,?,?), ref: 0263D717

Memory Dump Source

Source File: 0000000C.00000002.1523347611.0000000002630000.00000040.00000800.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2630000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a0f7d59157596517b3221f3c995f9a0679b65501f088d47482c2439e5e100cbe
Instruction ID: a94dd8ce38836c94707a2cc6440ade0343f35aef29dbde56b4d2dcce1a3fa78c
Opcode Fuzzy Hash: a0f7d59157596517b3221f3c995f9a0679b65501f088d47482c2439e5e100cbe
Instruction Fuzzy Hash: 0421E4B5D00248AFDB10CFAAD584AEEFBF4EB48314F14805AE918B3310D374A954CFA5

Function 052CA5E9 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 052CA66E

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 19b8b831203c67a0f76d0eec340680da5579b65d73e233f5e6ab62c5dc3d0a54
Instruction ID: 4691cd7c510f49725cbe2840d664aab6948c827ff4f7bcf8bd7e4bea3dd73cab
Opcode Fuzzy Hash: 19b8b831203c67a0f76d0eec340680da5579b65d73e233f5e6ab62c5dc3d0a54
Instruction Fuzzy Hash: 45213472D102098FDB10DFAAC4857EEBBF4EF88324F14842ED559A7241CB78A945CFA1

Function 052CA5F0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 052CA66E

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4843178532932b52186fa0244755b4b7fbac22a91d76ad33c955c146306373c8
Instruction ID: 36f6fcb99b606d5d0b686011a3723381c59e8e03a5a8ebc5c6cd3506fe5bac0e
Opcode Fuzzy Hash: 4843178532932b52186fa0244755b4b7fbac22a91d76ad33c955c146306373c8
Instruction Fuzzy Hash: E4213571D002098FDB10DFAAC4857EEBBF4EF48324F14842ED419A7241CB78A945CFA1

Function 052CA878 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 052CA8F8

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c4698e2f1f5ff30d74bb11520fc082d8153078cabe0ef8d9f283661c3ba9d161
Instruction ID: 516efda1d072314e70bd3dd4e5dfc5c0c4d1bacc26dcd8b043225481d72ddf94
Opcode Fuzzy Hash: c4698e2f1f5ff30d74bb11520fc082d8153078cabe0ef8d9f283661c3ba9d161
Instruction Fuzzy Hash: 8D2116B1D0024D9FDB10DFAAC881ADEFBF5FF48310F10842AE519A7240C7799945CBA1

Function 0263D689 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0263D656,?,?,?,?,?), ref: 0263D717

Memory Dump Source

Source File: 0000000C.00000002.1523347611.0000000002630000.00000040.00000800.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2630000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4b6cc2da1a1b7b55fe5eec6c03db3f341c41e9e6be838e654084cef14256624d
Instruction ID: 1dfa51566fdb5eea07b183b8a30b3a3616f7075d63a771f0a44747a01b2931a0
Opcode Fuzzy Hash: 4b6cc2da1a1b7b55fe5eec6c03db3f341c41e9e6be838e654084cef14256624d
Instruction Fuzzy Hash: B621E2B5D00249DFDB10CFA9D584ADEBBF5EB48314F14805AE918B3350D378AA54CFA5

Function 052CA6C1 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 052CA736

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1ab7358f47df32a185865e33c04b0ff41720b68991fe4722d0a08c5626679f0a
Instruction ID: d1a4645cc9597ee552c5f2075a119d9dc2e7c2b5da32d2292ea7457721bae25f
Opcode Fuzzy Hash: 1ab7358f47df32a185865e33c04b0ff41720b68991fe4722d0a08c5626679f0a
Instruction Fuzzy Hash: 5A1156728002099FDB20DFAAC845ADEFFF5FF88320F14841AE519A7250C775A944CFA0

Function 052CA6C8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 052CA736

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 80e044ca6a9f83db995374f650912dbc3ef064da7ba9a63138c980a5a65d4a40
Instruction ID: 654239c8ad49af173715016ca02578b2253f72a0708ef8da63e5285f2c771640
Opcode Fuzzy Hash: 80e044ca6a9f83db995374f650912dbc3ef064da7ba9a63138c980a5a65d4a40
Instruction Fuzzy Hash: 67113472D002499FCB20DFAAC845ADEBFF5FF88320F14841AE519A7250C775A944CFA1

Function 052CA100 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 052CA16A

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9fed65c1a9225045f0143e006806e326f7cc7c96d1eba93b3ad04ebad1bda003
Instruction ID: 66805f777175eefc760d0bb950fc038b2c41f2b33aebcd65e4444cb86f0fffad
Opcode Fuzzy Hash: 9fed65c1a9225045f0143e006806e326f7cc7c96d1eba93b3ad04ebad1bda003
Instruction Fuzzy Hash: CE1146B1D042498FDB24DFAAC44579EFFF4EF88324F14841AD519A7240CB75A945CBA4

Function 052CA108 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 052CA16A

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3d4d26a825a6b17c5382f207f981d25d31f5df1119650587c5552bca11b3fbbc
Instruction ID: 8702fd70e70c809f455014529d7f54b42aa06403da40f20e12546402dece0e73
Opcode Fuzzy Hash: 3d4d26a825a6b17c5382f207f981d25d31f5df1119650587c5552bca11b3fbbc
Instruction Fuzzy Hash: 751136B1D042498FDB20DFAAC8457DEFFF4EF88324F24841AD419A7240CB75A945CBA5

Function 052CAA18 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 052CD33D

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1d4abccc9ea6a4ee9a504fa1d6efe13d204ee8e2dd40767c575e4f5da19d5c6a
Instruction ID: 8746652ca9e48d145131f9df04c2d06020e7287dd5a626fbe6c3e504510c518c
Opcode Fuzzy Hash: 1d4abccc9ea6a4ee9a504fa1d6efe13d204ee8e2dd40767c575e4f5da19d5c6a
Instruction Fuzzy Hash: 3F1122B68003499FDB10DF9AC849BDEBFF8EB48310F108459E918A7201C375A944CFA5

Function 0263AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0263AFFE

Memory Dump Source

Source File: 0000000C.00000002.1523347611.0000000002630000.00000040.00000800.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2630000_mpTrle.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 37991b71137dc6ea128051a35ce890bd6177cd47ec29e6db1cca887aced8960e
Instruction ID: 06f42f061b656536d2acad86f756e98a24a2be5ae6c8367774b68de223f3c273
Opcode Fuzzy Hash: 37991b71137dc6ea128051a35ce890bd6177cd47ec29e6db1cca887aced8960e
Instruction Fuzzy Hash: 4B11E0B6C002498FDB10DF9AD544ADEFBF4EF88318F14846AD829B7210D375A545CFA1

Function 052CD2D8 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 052CD33D

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 17121ef22438ef10138eb905e4bb0f025c1b2f2ca7df2bd100520f911f78acac
Instruction ID: f34fcb6a9cca6836b82758088abda56790e9433ce20f355c9a3f47b240f5c9e2
Opcode Fuzzy Hash: 17121ef22438ef10138eb905e4bb0f025c1b2f2ca7df2bd100520f911f78acac
Instruction Fuzzy Hash: 7D11F2B58043499FDB20DF99D485BDEBFF4FB88314F24845AE558A7240C375A944CFA1

Function 052CDD60 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,052CE759,?,?), ref: 052CE900

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a43e839cd7f861be616489b88aa25736b129de800d6e43c69ec4a7b59861f330
Instruction ID: f1731ccb1c2daf4b5a23957803931ae3d6ea51bd96ba59af97c0ec87fda50ea9
Opcode Fuzzy Hash: a43e839cd7f861be616489b88aa25736b129de800d6e43c69ec4a7b59861f330
Instruction Fuzzy Hash: 7F1158B18002098FDB20DF99C445BDEBBF4EF48320F118459D958A7241D378A544CFA5

Function 052CDDAC Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,052CE759,?,?), ref: 052CE900

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5cffa7e60f368a2a74ef403c98cb45a43cad737c57d58cd6d85c219e98fe12df
Instruction ID: 8b758754b5a56a91d2358cda0ed0f239e9509d3f6ee8096bda72935caa3d68d5
Opcode Fuzzy Hash: 5cffa7e60f368a2a74ef403c98cb45a43cad737c57d58cd6d85c219e98fe12df
Instruction Fuzzy Hash: 8D1155B18002498FDB20DF99C489BEEBBF4EF48320F118469E958A7241D378A944CFA1

Function 052CDDB8 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,052CE759,?,?), ref: 052CE900

Memory Dump Source

Source File: 0000000C.00000002.1544104084.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_52c0000_mpTrle.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e31abd70ea04138670b1f35704f1d1b0c49b9ddf3377b28c68dc24b3b5dd70e0
Instruction ID: e6d7f9c98c4afde16d6acd565c2391d9990150e096b903e1f77107a4dfcf1231
Opcode Fuzzy Hash: e31abd70ea04138670b1f35704f1d1b0c49b9ddf3377b28c68dc24b3b5dd70e0
Instruction Fuzzy Hash: 021155B1C003498FDB20DF9AC489BDEBBF4EF48320F118469E958A7241D378A944CFA1

Function 0245D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522652459.000000000245D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0245D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_245d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c47f30019f6345aca7349fbfb0d5ee294c3eab57a8be756b1cd0fdc0b6cee8
Instruction ID: abf20a78576beff635facbcfe50a12b4eadf2af8a03a800fa688202f49e79caf
Opcode Fuzzy Hash: a6c47f30019f6345aca7349fbfb0d5ee294c3eab57a8be756b1cd0fdc0b6cee8
Instruction Fuzzy Hash: 7621E0B1904200EFDB05DF54D980B2BBB65FF88310F20C5AAFD890E256C336D456CAA1

Function 0245D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522652459.000000000245D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0245D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_245d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3929e374409b8731e7201a8868872520e69257ccd8953110f22e8d0911560f33
Instruction ID: 21cc1613235912e7d7ddb2ef2554ef56b27c989a9d79d1aa74b40936355cb27a
Opcode Fuzzy Hash: 3929e374409b8731e7201a8868872520e69257ccd8953110f22e8d0911560f33
Instruction Fuzzy Hash: 9321C171904248EFDB05DF14D980B27BF65FF88318F24C56AED890B25BC336E456CAA1

Function 0246D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522741358.000000000246D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0246D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_246d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7461ac59aaba378594031485550cfc2c6ee2a713c08e80147b95f75d929235
Instruction ID: 06004182ebb33d2df39a0567790264bd4ef2e1ea04b57a7bed541557c40839a9
Opcode Fuzzy Hash: bc7461ac59aaba378594031485550cfc2c6ee2a713c08e80147b95f75d929235
Instruction Fuzzy Hash: 57210771A04204DFDB05DF14D9C8B36BB65FB88314F24C56EE8094F355C376D446CA62

Function 0246D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522741358.000000000246D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0246D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_246d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25ac9bec341c8a70beefa52cedb12e85bfaffe5f9ab05d140fadc0f86244ae3
Instruction ID: 51e9226aa1e60f5f906a33852868a3491e930a647410e18f17b7fe76e96c9752
Opcode Fuzzy Hash: a25ac9bec341c8a70beefa52cedb12e85bfaffe5f9ab05d140fadc0f86244ae3
Instruction Fuzzy Hash: 2A21F275A04244DFDB14DF14D988B26BBA5EB88318F24C56AE90A4B356C33BD447CAA2

Function 0246D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522741358.000000000246D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0246D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_246d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fba339e4aad9432d54dbb2d62e271234752fb63526b284214de9a9210b95fbe
Instruction ID: 4a07e7e554a4908a2bda4dd2c5ca567ddb6e8c46b5abb40dead5f7f2a2275a80
Opcode Fuzzy Hash: 7fba339e4aad9432d54dbb2d62e271234752fb63526b284214de9a9210b95fbe
Instruction Fuzzy Hash: 38218075509380CFCB02CF24D594716BF71EB46218F28C5DBD8898B2A7C33A940ACB62

Function 0245D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522652459.000000000245D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0245D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_245d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e913fbe4a6093fe52002ebff3728cbe293fe76fa7d723964536c1d21f6342d
Instruction ID: 37ba389ba308e781c02b213a96a4f75bfe1fcbe8315c26a1fec19838d43ec0df
Opcode Fuzzy Hash: 21e913fbe4a6093fe52002ebff3728cbe293fe76fa7d723964536c1d21f6342d
Instruction Fuzzy Hash: 1B219D76904244DFDB06CF50D9C4B16BF62FF84314F24C5AAED494A656C33AD42ACBA1

Function 0245D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522652459.000000000245D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0245D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_245d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction ID: 33269d842bf8007c44e35b889cf7cccaeeaff03b6026d467c85488b98cdf1bf2
Opcode Fuzzy Hash: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction Fuzzy Hash: 7711AF76904284CFCB16CF14D9C4B16BF71FB84318F24C6AADC490B656C336D45ACBA1

Function 0246D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1522741358.000000000246D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0246D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_246d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 5542cb9b81cc53cd30d06756549755789c6f578414c04176affce8911cf29346
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: E5118E75A04244DFDB15CF14D5C4B26BB61FB84214F28C6AAD8494F756C33AD44ACB52

Analysis Process: mpTrle.exePID: 7380, Parent PID: 6388COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	126
Total number of Limit Nodes:	12

Executed Functions

Function 0670B230 Relevance: 8.3, Strings: 6, Instructions: 770COMMON

Download Yara Rule

Strings

$_q, xrefs: 0670BBF9
$_q, xrefs: 0670BBC5
$_q, xrefs: 0670BB91
$_q, xrefs: 0670BBD1
$_q, xrefs: 0670BC05
$_q, xrefs: 0670BB9D

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: ce4ecb2b665ac3595305ff7962dcf415794b6f1a4cf7dbda6d6ca9ec44cbe0cc
Instruction ID: bbe702cceeafdcdd2ef18b607425e7bd899baca85eb2f795c0e8bdb15c0d746e
Opcode Fuzzy Hash: ce4ecb2b665ac3595305ff7962dcf415794b6f1a4cf7dbda6d6ca9ec44cbe0cc
Instruction Fuzzy Hash: BF528134E10209DFEF64CB68C5847ADB7E2EB85710F20886AE405DB395DB36DE45CBA1

Function 06703490 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 06703BC4
$_q, xrefs: 06703B9B
$_q, xrefs: 06703BDC
$_q, xrefs: 06703BE8
$_q, xrefs: 06703BB8
$_q, xrefs: 06703B8F

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: c71dc17d1fee2503356ff997e967695b426f5b0cb4b508d8e6d6f1ab2aa47e7f
Instruction ID: ce612dc6ecf58efd56559e66b0a42f54b8d21ea0715e0230e81d1ba4d0ac2b11
Opcode Fuzzy Hash: c71dc17d1fee2503356ff997e967695b426f5b0cb4b508d8e6d6f1ab2aa47e7f
Instruction Fuzzy Hash: B7322F34E1061ACFDB14EF75C8946ADB7F2BFC9310F11C6AAD409A7264EB709985CB90

Function 06707D70 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0670830B
$_q, xrefs: 06708317

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: b80228b0dfc07b09b77d3854b93300c12166f23f38f69daad8b9cf3266fef2f5
Instruction ID: 15536c7d40f3928e3a2401854aeee66e263ce63e1e57b76f22f6cbcc333fa464
Opcode Fuzzy Hash: b80228b0dfc07b09b77d3854b93300c12166f23f38f69daad8b9cf3266fef2f5
Instruction Fuzzy Hash: D9029A34B00606DFEF54DB68D994AAEB7E2BF84314F148529D409DB394DB31EC46CBA2

Function 067065E8 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968f18f91af523f93034e59aa641a5d49444d276ea597624589077f8bbda4e96
Instruction ID: 1c7711702a4f6c1382f1e457b2234d66739fd9d92a92d22c91f4e9b78d1c2272
Opcode Fuzzy Hash: 968f18f91af523f93034e59aa641a5d49444d276ea597624589077f8bbda4e96
Instruction Fuzzy Hash: A3628C34A10205CFEB54DB68D594BADB7F2EF88314F208569E406EB394DB35ED46CBA0

Function 0670C178 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7afce68aeb186aa7b1ab1bf49151c6d60654dbfa6e15a3060214384b1e05ea
Instruction ID: ddca9df1ba0ae2a71b88e5d679b1e61d488bf6e9f6fae55daff39ff9a6b01e1e
Opcode Fuzzy Hash: cb7afce68aeb186aa7b1ab1bf49151c6d60654dbfa6e15a3060214384b1e05ea
Instruction Fuzzy Hash: 87327D34B10209DFEB55DB68D984BADB7F2FB88314F108625E505EB395DB30EC468BA1

Function 067055D0 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b7cd4eed13352a8886e670fe2b949709543975c83d624ae7ae02be45153686
Instruction ID: 86a4309551f2214a88c178227a71af2cfeae948996291fc3f8bc9731b0ce4c50
Opcode Fuzzy Hash: 08b7cd4eed13352a8886e670fe2b949709543975c83d624ae7ae02be45153686
Instruction Fuzzy Hash: 6B12D075E10205DBFF64DB64C98067EBBE2EB85310F248969D81ADB384DA34DC46CFA1

Function 0670ACC8 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0670AE48
$_q, xrefs: 0670ADF5
$_q, xrefs: 0670AE3C
$_q, xrefs: 0670ADE9
$_q, xrefs: 0670AE6B
$_q, xrefs: 0670AEA0
$_q, xrefs: 0670AE94
$_q, xrefs: 0670AE77

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: ea2986ad5e123adf87d566bb2b667e2963b873ecb8d96a0dddc6a1bf6275c89a
Instruction ID: f8cba34e7c4458dc9de2f7a0176513819f80b4470586be72c19d82ed808cdb37
Opcode Fuzzy Hash: ea2986ad5e123adf87d566bb2b667e2963b873ecb8d96a0dddc6a1bf6275c89a
Instruction Fuzzy Hash: 00E16C34E1030ACFDB55DB68D5946AEB7F2BB85304F208529E805EB399DB31EC46CB91

Function 06709148 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0670918F
$_q, xrefs: 0670919B
$_q, xrefs: 067091CA
$_q, xrefs: 067091D6

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 745a219443ef7280b508ad9abeadbf21b0e79af2f250b32d4ddda66be4891a74
Instruction ID: 41147bee07e9b30d25702fa3c175dc1ff8cea14d09c99461de7dfcdfcdec406b
Opcode Fuzzy Hash: 745a219443ef7280b508ad9abeadbf21b0e79af2f250b32d4ddda66be4891a74
Instruction Fuzzy Hash: 65919030F0060A9FDB54DF74D9507AEB3F6BB88200F108469D509EB389EA70AD46CB91

Function 0670CF38 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0670D32F
$_q, xrefs: 0670D337
$_q, xrefs: 0670D343

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q
API String ID: 0-2441406858
Opcode ID: 37d3684b3f180899643374d3db1fe2e9b630dabe43568e5c70611f1475df8105
Instruction ID: 5bd5f4234de78c765756b3b56ec20bc08f7b7c855f392b02f06a09cfa1a83109
Opcode Fuzzy Hash: 37d3684b3f180899643374d3db1fe2e9b630dabe43568e5c70611f1475df8105
Instruction Fuzzy Hash: 5B622C34A00206DFDB55EBA8D590B5DB7F2FF84304B208A69D009DB769DB71EC4ACB91

Function 06704B98 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fdq, xrefs: 067052A5
\Odq, xrefs: 06704D4F
XPdq, xrefs: 06704CC5

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: fdq$XPdq$\Odq
API String ID: 0-727959394
Opcode ID: 4af000e5640831e8e63af98a4830c1b3b2e80d445134ad6c7de2ceeab10fcfa7
Instruction ID: bb96d96ced5ae3181044d828e1a96ab8d9500c550708300d4cfd0e21467d8e93
Opcode Fuzzy Hash: 4af000e5640831e8e63af98a4830c1b3b2e80d445134ad6c7de2ceeab10fcfa7
Instruction Fuzzy Hash: E5616F74E00218DFEB549BA9C8547AEBBF6EF88310F20842AD605EB395DB754C458F91

Function 0670913A Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0670918F
$_q, xrefs: 067091CA

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: 2d1fc5a8d0f64ef7dcbd915b55f515fbb34d265fa3f4c0ac4e41ac315ca9057f
Instruction ID: f65b336db270c37c66c9ecb8599bd336ceb7f7999b94b0fd56d0ef0173cceac5
Opcode Fuzzy Hash: 2d1fc5a8d0f64ef7dcbd915b55f515fbb34d265fa3f4c0ac4e41ac315ca9057f
Instruction Fuzzy Hash: 20518374F005069FEB54DB74D950BAEB3F6BB88640F10842AD509DB399EA31EC42CBA1

Function 066FD8EF Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 066FDA02

Memory Dump Source

Source File: 0000000D.00000002.2560235585.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66f0000_mpTrle.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 445930e3a0605dc332b05754149d8bab542713b4b52f859ea16c598913069564
Instruction ID: a6169c7f77f2286985e65e97f88f93a9e804f1faccab6d07fdf38ced4a04919a
Opcode Fuzzy Hash: 445930e3a0605dc332b05754149d8bab542713b4b52f859ea16c598913069564
Instruction Fuzzy Hash: C241C0B1D103099FDB14CFA9C884ADEFBF5BF49310F24812AE819AB210D774A885CF90

Function 066FD8F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 066FDA02

Memory Dump Source

Source File: 0000000D.00000002.2560235585.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66f0000_mpTrle.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ec96bb054124f0060ca4c38678f8888b16f767fd617b0f5cd95ebc0a385b5d30
Instruction ID: abe940c0d1ec0497382b457ed69849014c3918d69bfbf854d8c38417424d749a
Opcode Fuzzy Hash: ec96bb054124f0060ca4c38678f8888b16f767fd617b0f5cd95ebc0a385b5d30
Instruction Fuzzy Hash: D141CFB1D103099FDB14CFA9C884ADEFBF5BF49310F24812AE819AB210D774A885CF90

Function 02A3F018 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02A3F0BF

Memory Dump Source

Source File: 0000000D.00000002.2544979083.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a30000_mpTrle.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5dd823e8f5832bb086ffe15fed6ce4cc0501f7901c691aa932014306b130d5fc
Instruction ID: fc6bf6eb859ab1be0b2256123c2b751f0d11921748dd305fe12469d88e25db2d
Opcode Fuzzy Hash: 5dd823e8f5832bb086ffe15fed6ce4cc0501f7901c691aa932014306b130d5fc
Instruction Fuzzy Hash: 0A219AB1C0425A9FCB14DFA9D44479EFBF4AF48320F11856AE808A7641E738A945CFA1

Function 066F32D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 066F335F

Memory Dump Source

Source File: 0000000D.00000002.2560235585.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66f0000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 983357db90b3e705e9aeeb7efc7421bd07884c6cf9e748882205f2262f61a712
Instruction ID: ffdc5acf4b6e6cf7bd916bbbb6e771301ca7e69f0f914b839c889abe100c76bf
Opcode Fuzzy Hash: 983357db90b3e705e9aeeb7efc7421bd07884c6cf9e748882205f2262f61a712
Instruction Fuzzy Hash: D021E3B5D002489FDB10CFA9D984AEEBBF4EB48310F14801AE918A3350D374A954CFA1

Function 066F32D8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 066F335F

Memory Dump Source

Source File: 0000000D.00000002.2560235585.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66f0000_mpTrle.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a5f39057e8850b14ce81da2de73bfe81c866d4ec621ba78977c187452fce7b06
Instruction ID: b42da6980561ce61675ac0509709b12b58503d754a781dd81fb0b52a54e4b6e2
Opcode Fuzzy Hash: a5f39057e8850b14ce81da2de73bfe81c866d4ec621ba78977c187452fce7b06
Instruction Fuzzy Hash: 5521B3B5D00248AFDB50CFAAD984ADEBBF4EB48310F14841AE918A3350D374A954CFA5

Function 02A3F058 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02A3F0BF

Memory Dump Source

Source File: 0000000D.00000002.2544979083.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a30000_mpTrle.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ef2d9ae50bd2784c2acce3fe75578c6e1e10a76faf90808effb3ea080a993359
Instruction ID: 006ac760415a5432f2af19edcd75f7b6f6052dcac45ad8e09238d35b3f7b4846
Opcode Fuzzy Hash: ef2d9ae50bd2784c2acce3fe75578c6e1e10a76faf90808effb3ea080a993359
Instruction Fuzzy Hash: 041123B1C006599FCB10DF9AC544BDEFBF4AF48320F11816AE818B7240D778A944CFA1

Function 066FAAD0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,066FB73C), ref: 066FB976

Memory Dump Source

Source File: 0000000D.00000002.2560235585.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66f0000_mpTrle.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7d7cb13539db56f182a4d60d008ff7ed1f9bdc224f7be0967bd4a805586c9c28
Instruction ID: c96c137e6a60eeb24a6008caeae734ab132b95a4461d17b985b7f454ea94c1da
Opcode Fuzzy Hash: 7d7cb13539db56f182a4d60d008ff7ed1f9bdc224f7be0967bd4a805586c9c28
Instruction Fuzzy Hash: B31132B5C002498FCB50DF9AC444A9EFBF4EB49310F10842AD929B7310C375A545CFA1

Function 06704B88 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

XPdq, xrefs: 06704CC5

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: XPdq
API String ID: 0-1708276200
Opcode ID: 36ef1edb5881575a15e999ecca25eb70658e5f07b210cf074edae21de6cf63e9
Instruction ID: ed39a4f9e8d0119a61b37f2263a3aec6a6cebfd7e9a01670358895cd4b912881
Opcode Fuzzy Hash: 36ef1edb5881575a15e999ecca25eb70658e5f07b210cf074edae21de6cf63e9
Instruction Fuzzy Hash: 93415174F102089FEB549FA5C854BAEBBF7AF88700F208529E205EB395DA714C058B51

Function 0670DAC0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0670DC09

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 597430c096eba761b5b885647ae091db26ba14a05c61f32b646f2ee5e98ab386
Instruction ID: 258eacba1828f1f8a054d5afafbb1c90b6113d553b8df2794795c8da040a54f8
Opcode Fuzzy Hash: 597430c096eba761b5b885647ae091db26ba14a05c61f32b646f2ee5e98ab386
Instruction Fuzzy Hash: 5A415070E0030ADFEB64DFA5C5546AEBBF6BF85340F208929E406D7284DB71E945CB91

Function 0670DAAD Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0670DC09

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 43d34126cae9a17a715f06d973e9e43bef0e268a343e0c0fb1bebe96df6a023b
Instruction ID: 5dd006e717d28cedc958fb1e12baff499b6080f5790c23b329446e113611466b
Opcode Fuzzy Hash: 43d34126cae9a17a715f06d973e9e43bef0e268a343e0c0fb1bebe96df6a023b
Instruction Fuzzy Hash: 9D416270E00305DFEB65DFA5C5946AEBBF6BF85300F104929E805DB280DB71E946CB51

Function 067021E5 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PH_q, xrefs: 06702333

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: dd0f54c802279d437366f694dffd31383e6f492e43314cc286998e4715bf9f56
Instruction ID: c1088aea726df2eaca8a4a9843bfa44a1e84c9d179f7cfc48c44bfa54b71b906
Opcode Fuzzy Hash: dd0f54c802279d437366f694dffd31383e6f492e43314cc286998e4715bf9f56
Instruction Fuzzy Hash: 1131EE31B002018FEB49ABB4D45877E7BE6AB89300F218969D406DB396DF35DD46CBA1

Function 067021F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH_q, xrefs: 06702333

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 519542d73457db70bfabacf70985b9a14622175cc58957e5e986fa21398a676b
Instruction ID: bfc96859ed205442c8dffa9e2e8eb391cf158e3a5c1783721607ba3b8056059c
Opcode Fuzzy Hash: 519542d73457db70bfabacf70985b9a14622175cc58957e5e986fa21398a676b
Instruction Fuzzy Hash: 8731F031B002018FEB49ABB4C41867E7BE7AB88300F218869D406DB395DE35DD46CBA1

Function 067082C0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$_q, xrefs: 0670830B

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q
API String ID: 0-238743419
Opcode ID: 7b83c227e09aca68fae45fe46b1fdda3a1d90f25fb010141376674be983b41a8
Instruction ID: bbbd96d1014f9a3ee72947fecdbffbaff65aeb8c24ec43816321ce54f06b640d
Opcode Fuzzy Hash: 7b83c227e09aca68fae45fe46b1fdda3a1d90f25fb010141376674be983b41a8
Instruction Fuzzy Hash: 00F08C35A00205CFEF649AB5EA806BCB3E5EBC8354F148066D905CB295D631EA41C762

Function 0670B220 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ec563ba2db85a5314a2074a3d73498c974b824e750d1f9ad13e9523c5c2652
Instruction ID: 032cb011a52dabf071175f02d9c4149c6f50efeb5b46cf06e84a33616ee148d7
Opcode Fuzzy Hash: 02ec563ba2db85a5314a2074a3d73498c974b824e750d1f9ad13e9523c5c2652
Instruction Fuzzy Hash: 2AA18334E00109DBFF64CB6CD5947BEB7E6EB89710F204829E409E73D5DA25DD818B61

Function 0670B638 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ff879484bcd5733b658007a068513166bc81ed039f15346b8777f76da36fe3
Instruction ID: a462b0a052089871fc603dca524e2197d81de4114b6e89b36905a4825ef771f7
Opcode Fuzzy Hash: 49ff879484bcd5733b658007a068513166bc81ed039f15346b8777f76da36fe3
Instruction Fuzzy Hash: AAA15834E1020ACBEFA0CB69C484BADB7F1EB45710F148966E419DB395D732DE85CBA1

Function 067061E8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407c2798c037f1a2b37177db27f787b0479d909832b5f4a193dc7e1107331f2a
Instruction ID: 3ba03156e9a1d246950b968c7b89c987804da14bc0298a9dcb193ebaaeb547bd
Opcode Fuzzy Hash: 407c2798c037f1a2b37177db27f787b0479d909832b5f4a193dc7e1107331f2a
Instruction Fuzzy Hash: 84618EB1F400114FDB549B6DC89466FBADBAFC4224B154439E80EDB364DEA5DD0287D2

Function 067045E8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d482988d8145dfcac4c3aa5baa5c54f2cff9f6a19193f32455847bd82b151a1e
Instruction ID: 176d303c6404bff4f55c26c1fcacba187ac3588b77ecedf6575fe24781366cd4
Opcode Fuzzy Hash: d482988d8145dfcac4c3aa5baa5c54f2cff9f6a19193f32455847bd82b151a1e
Instruction Fuzzy Hash: 83913C34E10259CFDF60DF68C890B9DB7B1FF85300F208599D549AB299EB70AA85CF91

Function 067042CA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25438568ba5f9e8794c62bec0e7cba3303275bb7185bd55eefd56ac1a7ef629
Instruction ID: 60bd18daf0873d7ba72f8fc9b575a0c40f9f7f4bb6725a19a0cfe6f08626e08f
Opcode Fuzzy Hash: d25438568ba5f9e8794c62bec0e7cba3303275bb7185bd55eefd56ac1a7ef629
Instruction Fuzzy Hash: AC813C34B0020ADFEB54DBB4D55476EB7F2AB88304F108529E50AEB398EB71DC428B91

Function 067042D8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aebf4d0794fd58124eebac29fd274ff599b45db50578d4f545d1d394d6cec2bb
Instruction ID: 01d97996040fc57411b53677253d1f7f2d8ce74a0b18980e5631e792316a13a9
Opcode Fuzzy Hash: aebf4d0794fd58124eebac29fd274ff599b45db50578d4f545d1d394d6cec2bb
Instruction Fuzzy Hash: 19814C34B0020ADFDF54DBB4D55476EB7F6AB88304F108529E50AEB398EB71DC428B91

Function 06704600 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1c3cccc8618564a7316e30d663b879cee9a38ba858fdaea29ca2144952d9ea
Instruction ID: 8335b3992db290009f666bcde5d05550cba408f0da28c80e64251a77f02a2dfd
Opcode Fuzzy Hash: 5f1c3cccc8618564a7316e30d663b879cee9a38ba858fdaea29ca2144952d9ea
Instruction Fuzzy Hash: E0913E34E10619CBDF60DF68C880B9DB7F1FF89310F208599D549BB295EB70AA858F91

Function 0670EF00 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09783b5a2ef4898f7ccc63a6160ae85548f11551ad03b0f81c6ed146c8cdb6bd
Instruction ID: e730cd76af7e97f868d30102b0a0fef214cc498a7212e3eee04a2552f074f231
Opcode Fuzzy Hash: 09783b5a2ef4898f7ccc63a6160ae85548f11551ad03b0f81c6ed146c8cdb6bd
Instruction Fuzzy Hash: E4713C74A00209DFDB94DBA8D984AADBBF6FF84300F148429E509EB254DB30ED46CB51

Function 0670EF10 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b4aed690422c711c1f335b69d5ae2d4092ba00db6f515873ab7d7e0a30b6c2
Instruction ID: 5c2d776c9b4d4f17977322e400f2279706c49424aaaeef55a908cabb7180cf93
Opcode Fuzzy Hash: 34b4aed690422c711c1f335b69d5ae2d4092ba00db6f515873ab7d7e0a30b6c2
Instruction Fuzzy Hash: F5714B74A00209DFDB94DBA9D984AADBBF6FF84300F148429E509EB358DB30EC46CB51

Function 0670FC70 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1ff7ed75006ee9970f5a4b21565ca37c69b8988ee9f80ac7dbcc1189f43edd
Instruction ID: 83c844f7d8f14cc4e01f3c1b8f81f0028745dc2520bdcdde88fec93c39317423
Opcode Fuzzy Hash: be1ff7ed75006ee9970f5a4b21565ca37c69b8988ee9f80ac7dbcc1189f43edd
Instruction Fuzzy Hash: 1E513431E00105DFEB64EF78E4542ADBBF2FB84315F20886AE909D7290DF398845CB91

Function 0670FA1F Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c598b0d28d372cf6112237e8720fd8ca5b4e66a6587ce11b75b6c4d618a955ca
Instruction ID: 445081e5162bf47e2a9d3406268bd5b3095b8b447cd7696fc40783db411c765d
Opcode Fuzzy Hash: c598b0d28d372cf6112237e8720fd8ca5b4e66a6587ce11b75b6c4d618a955ca
Instruction Fuzzy Hash: 6F51A730B50205DBFFB46678D95477F2AAAD789710F20492AF80AC73D9CA7DCC4587A2

Function 0670FA30 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26311281bc86cff37d0129bc6fd3f5e34d8f7b92e79972744d89fcaab646280
Instruction ID: 36271615abdb7d125b724fb7c0aa7733e0b50d6f640b7b245c67bcbf6da99ff3
Opcode Fuzzy Hash: c26311281bc86cff37d0129bc6fd3f5e34d8f7b92e79972744d89fcaab646280
Instruction Fuzzy Hash: 3051A270B50205DBFFB4666CD954B7F26AAD789710F20482AE80AC73D8CABDCC4547A2

Function 06705450 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fa4ef206573cf914d683ca1fae4a6ec6764e445eea8d7fe1cd5e280cc861f3
Instruction ID: cec8c5ce43964e45641b392fc25e2aa3b0cdb262d345e0281fddab7972c364e6
Opcode Fuzzy Hash: f5fa4ef206573cf914d683ca1fae4a6ec6764e445eea8d7fe1cd5e280cc861f3
Instruction Fuzzy Hash: 3A413D75E006099FEB60CE99D980ABFB7F2FB84210F10492AE215D7690D770E8958FA0

Function 067055C1 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa968bb10f9cbd6642ec849bdb8e5e67a07613e39e02c487d707ba40175638a
Instruction ID: e45f366116f0dc5a81d55e66855b120bafb29ac3032fe1e49d92bf0c9a3f0b1d
Opcode Fuzzy Hash: 5fa968bb10f9cbd6642ec849bdb8e5e67a07613e39e02c487d707ba40175638a
Instruction Fuzzy Hash: 8E31AF70E00205CBFF70CA68CA8077EB7F2EB45720F24892AD059DB281E635D991DFA1

Function 0670D960 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726e5f2b63ba23c198b9254dce17b4b503cf38253b504bb3754e6572a3ca1bb8
Instruction ID: eac626134c027451c4212ec493bc472a29462cd6d43b4fb7c01ab10520c74c1d
Opcode Fuzzy Hash: 726e5f2b63ba23c198b9254dce17b4b503cf38253b504bb3754e6572a3ca1bb8
Instruction Fuzzy Hash: 66319430E1030ADBDF64DFA9D89069EB7F6FF85304F204929E405EB254EB70A9468B91

Function 067020A8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5420679bf381a79e3ed21e7490b8af8902ed1516a6f5c736549e2628c1886f0f
Instruction ID: fe987c6e10b8d94ffe58e74810fadcf03f7b052230d271894b15d9dd0122e269
Opcode Fuzzy Hash: 5420679bf381a79e3ed21e7490b8af8902ed1516a6f5c736549e2628c1886f0f
Instruction Fuzzy Hash: D831A031E1060ADBDB15CF64C854AAEBBF6AF89310F10C529E815EB395DB71AD42CB50

Function 067020B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a922c578d459873b51cb5c29b52b21a2057e37828158d0bb360fa83463a70d
Instruction ID: 17db6f8a1623a42b62538afa51709d22533ed761d6242a2737ce8c04cac1ce8b
Opcode Fuzzy Hash: 45a922c578d459873b51cb5c29b52b21a2057e37828158d0bb360fa83463a70d
Instruction Fuzzy Hash: F9317031E1020ADBDB54CF64D85469EB7F2AF89310F10C929E816E7795DB71AD42CB50

Function 06703ED1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce23e7339f6d485b2ef1ac48f2cd15b22ed1af6299ce175c7b95b6d02cae788c
Instruction ID: f2de4ddd062eb69ee8ebffabed119a9376dac996aa8135809be18992eef63689
Opcode Fuzzy Hash: ce23e7339f6d485b2ef1ac48f2cd15b22ed1af6299ce175c7b95b6d02cae788c
Instruction Fuzzy Hash: 3D21A075F00206DFEB10CF78D944BAEBBF5AB48620F148166E905E7394E735EC418B90

Function 06703EE0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1acd2aef6b934c8041001571a0716d514b605a68b8a24879657ee99a1b6cbc
Instruction ID: 5b503c2867609ddc63bcb583879326bf4f27950b6c10f5305b4b021d47caa631
Opcode Fuzzy Hash: 1d1acd2aef6b934c8041001571a0716d514b605a68b8a24879657ee99a1b6cbc
Instruction Fuzzy Hash: 7B217C75F00216DFEB50DF69D980AAEBBF5AB48710F108066E905E7394E731EC418BA1

Function 06705440 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6fc09ea619473ebe04a8a44f381df280e1c4ef4a9a29a5559ddd3ba1949e73
Instruction ID: 81ffc9d0ce6945382df50464e39d734f7efdb0c0b855ee7dbce0133640e6e73c
Opcode Fuzzy Hash: ed6fc09ea619473ebe04a8a44f381df280e1c4ef4a9a29a5559ddd3ba1949e73
Instruction Fuzzy Hash: 5C218171E00709DFEB60CEA9D985AAFFBF2FB44310F104929E15993590D770E8458FA0

Function 0290D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2544461749.000000000290D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0290D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_290d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee11e88901e04761db60706af9b2ff144ac7800cf7728537da75dc984264ab16
Instruction ID: 9aa8076471b72bb932f45566e237ab010828862a314d7d1730b5b57329a713e9
Opcode Fuzzy Hash: ee11e88901e04761db60706af9b2ff144ac7800cf7728537da75dc984264ab16
Instruction Fuzzy Hash: 6321F275504208DFDB14CF64D9C4F26BBB9FB88314F20C9A9E84D4B296C77AD846CA71

Function 06703481 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6085ea49ea30184dfbc59d8d5e515719d0e373c79e708c897fc537640a73db
Instruction ID: 3749f1a12370d12c7b033f8f694150034c83a5c14ce43f0d8778415f0ed7e925
Opcode Fuzzy Hash: 3b6085ea49ea30184dfbc59d8d5e515719d0e373c79e708c897fc537640a73db
Instruction Fuzzy Hash: 3E21D574E002199FDF549B79D8449EEB7F6EB89320F508969E10AE7340EA31D941CBA1

Function 06706D08 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b8051144b5914f843f79c460a8c84fd039ee644b07f3ba99772552c39e05e0
Instruction ID: 60f90944f47d6cabf1ead0b39fcbbd065a2ee9c874edc86007aad9aa00c2c869
Opcode Fuzzy Hash: 39b8051144b5914f843f79c460a8c84fd039ee644b07f3ba99772552c39e05e0
Instruction Fuzzy Hash: AD21A230F10119DFEF44DB69E9547ADB7F6EB84310F208425D505E7384DB31AC558B90

Function 06703FF0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3463450c99280ac335ede3eeb46df69eb70aaa51ef81bb6c439155ca48ca4f79
Instruction ID: b87fc9988894b7b28b52a375ef4b21d0c7017f1e6e8e87a3b73c1e805eff8660
Opcode Fuzzy Hash: 3463450c99280ac335ede3eeb46df69eb70aaa51ef81bb6c439155ca48ca4f79
Instruction Fuzzy Hash: 6611A535B24015DBEB48D678D8146EE73F6EBC8311F008575D506E7384EE66DC028BA1

Function 06704229 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f7ebd545377a2e06616cae5f1f0a4ad052727337ead842919e5534fcf68290
Instruction ID: 8a686bcd8abc8fb0fe2892261f0bfdeaf3a139a2581227ae887f169e2bcd9d63
Opcode Fuzzy Hash: 70f7ebd545377a2e06616cae5f1f0a4ad052727337ead842919e5534fcf68290
Instruction Fuzzy Hash: 0101F130B000148BEBA0D5AD9854B6BA7DADBC9720F10843AE20AC7399DD61DC0243E1

Function 06703CA8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fedf1171086261ecc382027cdae6d7d1b7c1435aa6217be30ba8a98f5febb4
Instruction ID: 6fcc6095b077b89d811432a6e037f15223d9285f29780cdaa12da8bb5a983839
Opcode Fuzzy Hash: 08fedf1171086261ecc382027cdae6d7d1b7c1435aa6217be30ba8a98f5febb4
Instruction Fuzzy Hash: C921EFB5804259AFCB00DF9AD884ADEFBB4FB49320F10852AE918B3240D374A954CBA5

Function 06703FDF Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa835685e16647fabb2a0ca0c0366aac4088e47cefb0683605cbce98daa6cc23
Instruction ID: 1717fc473cdf45c9e8cdfe83301d62141ae0a8c25cdffe42b7d81bacba50fcd1
Opcode Fuzzy Hash: aa835685e16647fabb2a0ca0c0366aac4088e47cefb0683605cbce98daa6cc23
Instruction Fuzzy Hash: 0F012832B24025EBEB449668DC046EF73FAEBC5310F008075D506E7384EE619C0247E1

Function 0290D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2544461749.000000000290D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0290D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_290d000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: f3499c10a61bbe0946e3fa9634b83c396319b7b4d7835f8354180ae843900d9f
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 0411DD75504288CFCB15CF50D9C4B15BBB2FB88318F24C6A9E8494B692C33AD84ACF62

Function 06703CB0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e34efd325da558c8457d18633d509a7753ba696462fe023d21ae62af9ff2462
Instruction ID: ef22d84dff2ce9ffd607a4cf9d0c10307bd6c01682c82cf7b6dc6620ef1b6010
Opcode Fuzzy Hash: 3e34efd325da558c8457d18633d509a7753ba696462fe023d21ae62af9ff2462
Instruction Fuzzy Hash: 0511CFB5D01259AFCB00DF9AD884ADEFBB4FB49320F10812AE918B7240C375A954CFA5

Function 0670F17F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0a517abbba74dba62c341c37b6090d339c6f7d58a1632b1c059048f3a992ac
Instruction ID: 84b9ab4ffffe1306c712adb8d1efbd46da166f9170f8b2b0056c071c3e22330e
Opcode Fuzzy Hash: 4e0a517abbba74dba62c341c37b6090d339c6f7d58a1632b1c059048f3a992ac
Instruction Fuzzy Hash: DA01F77AB000158BEB61DA7CE45577EA3D6DBC4320F10883AE90AC7385EE24CC0247A0

Function 06704238 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c968ce2570f32c312be6f7696a3fc58fd63c6a2624eb05e4e7c3e58bed1d13
Instruction ID: 12ea35c95f7a7d533006ae2dc1bcebd7e037f6a4377d074bddfbe021d02705cb
Opcode Fuzzy Hash: 44c968ce2570f32c312be6f7696a3fc58fd63c6a2624eb05e4e7c3e58bed1d13
Instruction Fuzzy Hash: 0001AD30B100248BEBA4D5AD9454B2AA2DADBC8720F10C43AE60AC7398EE61DC0243E1

Function 0670F190 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55ba08a0f1dcc9cb5195671455b8c5dfb3a4a70e8a974bcef92e39d28364a7c
Instruction ID: 617fed94122d66130e92fcffbd0960928c7bc11afbd6c797811255f22215b2cc
Opcode Fuzzy Hash: d55ba08a0f1dcc9cb5195671455b8c5dfb3a4a70e8a974bcef92e39d28364a7c
Instruction Fuzzy Hash: 1801D135B000148BDB60DA7DE854B3E63D6DBC8720F108839E90AC7385EE25DC0243A1

Function 0670A2FA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1318f9dca18fa689abb967c346a4555726623423f4984b944b5ce54efb54eb
Instruction ID: 83d1a79b4972e97bf6738f7b3893f3caf6f7c0a3db53ae571ed8744203e49853
Opcode Fuzzy Hash: fc1318f9dca18fa689abb967c346a4555726623423f4984b944b5ce54efb54eb
Instruction Fuzzy Hash: 1301A275F042004FEB50EA3CD955B2EA7D2EB8D761F508429E50AC7395EE21DC018791

Function 0670A308 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d1273df1044d7ad59d9d15921ddcd6f338d2f60dc55410c898e507b9eb8ea4
Instruction ID: fcce76b25461525953762a711ce0bf4a23d42acdb9242209c5ee19026a16632e
Opcode Fuzzy Hash: 06d1273df1044d7ad59d9d15921ddcd6f338d2f60dc55410c898e507b9eb8ea4
Instruction Fuzzy Hash: 17018134F102148FDB60EA3DD454B2EB7D6EB8A760F508439E50AC7395EE21DC028794

Function 06706468 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c92709b17fe2e6318dfe21e154c2cdd12154e8d2fa5f5dd12fef6e1edb2371
Instruction ID: e5da28c039a9b894439dcbd8cc6111d64dab022597b834fc559d88df0e4e9aee
Opcode Fuzzy Hash: 82c92709b17fe2e6318dfe21e154c2cdd12154e8d2fa5f5dd12fef6e1edb2371
Instruction Fuzzy Hash: E8F06530D05248EFEB50DFB0C959B2977E8DB01214F1188A5D418CB192E176DA6187A1

Function 06706478 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60989437eb31f36a88b24c626a9401e03f262ae62647aa4789d74cd00d0c7935
Instruction ID: 3a7170094d19c42f8bb05e1734f6cc1f32a591b508787ff70cf7ffca82e1b713
Opcode Fuzzy Hash: 60989437eb31f36a88b24c626a9401e03f262ae62647aa4789d74cd00d0c7935
Instruction Fuzzy Hash: 9EE0EC71E14109EBEF50DEA4D969B6A77EDEB01214F2088A5E408C7281F176DA1187A0

Function 0670FEDF Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f780d7f8647d8221705cde4ea9edbe3bea2c4acc937c6568a59dfb1e18cdfa
Instruction ID: a2b5a62bad4de1841563697679d4386ee2ffc6aae8c069ef4cb911bb00ffe93a
Opcode Fuzzy Hash: f4f780d7f8647d8221705cde4ea9edbe3bea2c4acc937c6568a59dfb1e18cdfa
Instruction Fuzzy Hash: 4AA00139112200CBCA9AAB7088509A53666BA8528A7E008AC952A0A2958A3AD843DA55

Non-executed Functions

Function 06707690 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$_q, xrefs: 06707BFE
$_q, xrefs: 06707BDC
$_q, xrefs: 06707B49
$_q, xrefs: 067077B1
$_q, xrefs: 0670778C
$_q, xrefs: 06707BF2
$_q, xrefs: 06707B3D
$_q, xrefs: 06707780
$_q, xrefs: 067077BD
$_q, xrefs: 06707BE8

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-698649689
Opcode ID: 24bea5727133d4119a8159900d9b7aa2c31dfeb77df12d8a3c7e562556ed106b
Instruction ID: 5be86cd6942f1703475addd5e02acb4abe6bf0b81e5d0432c2d109be5741285b
Opcode Fuzzy Hash: 24bea5727133d4119a8159900d9b7aa2c31dfeb77df12d8a3c7e562556ed106b
Instruction Fuzzy Hash: 12124F30E00219CFDB68DF65C954AAEB7F6BF88304F208569D509AB3A4DB31AD45CF91

Function 0670A930 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$_q, xrefs: 0670AAE2
$_q, xrefs: 0670AAB8
$_q, xrefs: 0670AA81
$_q, xrefs: 0670AA32
$_q, xrefs: 0670AA8D
$_q, xrefs: 0670AAEE
$_q, xrefs: 0670AA26
$_q, xrefs: 0670AAAC

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: 264e462ef45d046ecc24973b1c1a53dd043277c5c505e6ff7cfd78b1171824f5
Instruction ID: c2970060c1276d06121b514984326e662772623dd329899ccfb66d3d8991aa4c
Opcode Fuzzy Hash: 264e462ef45d046ecc24973b1c1a53dd043277c5c505e6ff7cfd78b1171824f5
Instruction Fuzzy Hash: 9A916C70A10309DFEB64EB65DA94BBEB7F2BF84300F208529E40197296DB759C45CBA0

Function 06707090 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$_q, xrefs: 067073CC
$_q, xrefs: 067075A4
$_q, xrefs: 0670752C
$_q, xrefs: 06707598
$_q, xrefs: 06707372
.5wq, xrefs: 067070EB
$_q, xrefs: 067073D8

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: .5wq$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-3129995876
Opcode ID: d9b837bb99c6ada8fe9f8dbd56c9074aca6ce8b8c0a2801c00aa99d28b6da4ea
Instruction ID: 8c5f9f894c88da7c12ca154e14a4f45468c47f242e19b1b7dcf0e0f774d745f6
Opcode Fuzzy Hash: d9b837bb99c6ada8fe9f8dbd56c9074aca6ce8b8c0a2801c00aa99d28b6da4ea
Instruction Fuzzy Hash: 67F12D34A00209DFEB59EF64D594B6EB7F3BF84300F248569D4069B3A9DB31AC46CB91

Function 067083C8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$_q, xrefs: 06708622
$_q, xrefs: 06708693
$_q, xrefs: 0670862E
$_q, xrefs: 06708687

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 39159727a52c8eb00c7bc18934a190b909bdf89394a57b9d8a678c899d4499bb
Instruction ID: 0c665384798c1b89d04ff2e5e53fb8e86820b6dc4aa2e3f4ef76ee56ad4a27ed
Opcode Fuzzy Hash: 39159727a52c8eb00c7bc18934a190b909bdf89394a57b9d8a678c899d4499bb
Instruction Fuzzy Hash: B4B13B34A00209CFEB54EFA8C59466EB7F2BF84300F248869E405DB399DB75DC86CB91

Function 067087E0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR_q, xrefs: 06708922
$_q, xrefs: 0670886B
LR_q, xrefs: 067088D3
$_q, xrefs: 0670885F

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: LR_q$LR_q$$_q$$_q
API String ID: 0-2912794808
Opcode ID: d04c5b8fffc3fd1549f8f32759e5561eb84e6065a3783f15360b559c6083377b
Instruction ID: ddc1f97aa0496bb00be35f0948f54d96eb42faed20efdf460918aea68a0d19bd
Opcode Fuzzy Hash: d04c5b8fffc3fd1549f8f32759e5561eb84e6065a3783f15360b559c6083377b
Instruction Fuzzy Hash: 4C51A034B10205DFEB58EB68C944B6AB7E6BF84304B148569E405DB3E9DB31EC41CBA2

Function 0670ACBA Relevance: 5.2, Strings: 4, Instructions: 158COMMON

Download Yara Rule

Strings

$_q, xrefs: 0670AE3C
$_q, xrefs: 0670ADE9
$_q, xrefs: 0670AE6B
$_q, xrefs: 0670AE94

Memory Dump Source

Source File: 0000000D.00000002.2560333774.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6700000_mpTrle.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: e02fdabc340976b8ca4ed7f4ec8384dd143a701c32779e4a7281d28e0b2a90e7
Instruction ID: 1d9194412ccff955adbc457d638bc3145027d39b9ca3c925ca9f221ce1279d12
Opcode Fuzzy Hash: e02fdabc340976b8ca4ed7f4ec8384dd143a701c32779e4a7281d28e0b2a90e7
Instruction Fuzzy Hash: 68514C34A10305DFEF65DB68D584AADB3F6FB88311F248529E805D729ADB31DC42CB61

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z68ORDER.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mpTrle.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z68ORDER.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhnjtjw2.guz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxjaekof.nwf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfgv3m3h.5oe.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mw2fwdi2.m3a.ps1

C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe

C:\Users\user\AppData\Roaming\mpTrle\mpTrle.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
z68ORDER.scr.exe

Function 04DB7750 Relevance: 4.5, Strings: 2, Instructions: 2009
COMMON

Function 04DB7740 Relevance: 4.4, Strings: 2, Instructions: 1889
COMMON

Function 06A88AA8 Relevance: 1.7, Strings: 1, Instructions: 438
COMMON

Function 00FED031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 00FED040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre