Windows Analysis Report
7uJ95NO82G.exe

Overview

General Information

Sample name: 7uJ95NO82G.exe
renamed because original name is a hash value
Original sample name: a9c526f3a276012d554ac382a90bca3d.exe
Analysis ID: 1580278
MD5: a9c526f3a276012d554ac382a90bca3d
SHA1: 34cab3f18d9a7efa115e154609fded0c2b96f9c8
SHA256: 7230b549346dbab880d1d713d8c9dfc1005065c0f0cebb16ad4f1a15f05d088a
Tags: exeuser-abuse_ch
Infos:

Detection

LodaRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LodaRAT
AI detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query the security center for anti-virus and firewall products
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Loda, LodaRAT Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as Trojan.Nymeria, although the connection is not well-documented. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.loda

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 7uJ95NO82G.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\Windata\svhost.exe Avira: detection malicious, Label: HEUR/AGEN.1321335
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Windata\svhost.exe ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\Windata\svhost.exe Virustotal: Detection: 66% Perma Link
Multi AV Scanner detection for submitted file
Source: 7uJ95NO82G.exe Virustotal: Detection: 66% Perma Link
Source: 7uJ95NO82G.exe ReversingLabs: Detection: 73%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 94.2% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Windata\svhost.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 7uJ95NO82G.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 7uJ95NO82G.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_004339B6
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00452492
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00442886
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_004788BD
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, 0_2_0045CAFA
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00431A86
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 0_2_0044BD27
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045DE8F FindFirstFileW,FindClose, 0_2_0045DE8F
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0044BF8B

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2822116 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon : 192.168.2.7:49751 -> 172.232.216.250:4000
Source: Network traffic Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.7:49751 -> 172.232.216.250:4000
Source: Network traffic Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.7:49801 -> 172.232.216.250:4000
Source: Network traffic Suricata IDS: 2822116 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon : 192.168.2.7:49904 -> 172.232.216.250:4000
Source: Network traffic Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.7:49904 -> 172.232.216.250:4000
Source: Network traffic Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.7:49854 -> 172.232.216.250:4000
Source: Network traffic Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.7:49954 -> 172.232.216.250:4000
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AKAMAI-ASN1EU AKAMAI-ASN1EU
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.216.250
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile, 0_2_004422FE
Source: 7uJ95NO82G.exe, 00000000.00000002.2543674143.0000000003D07000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.amazonaws.com/
Source: 7uJ95NO82G.exe, 00000000.00000002.2543249546.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-score.com/checkip/z
Source: 7uJ95NO82G.exe, 00000000.00000002.2543739108.0000000003D24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/files/beta/autoit/archive/sqlite/SQLite3
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_0045A10F
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_0045A10F
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard, 0_2_0046DC80
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput, 0_2_0044C37A
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_0047C81C
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle, 0_2_00431BE8
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00446313
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 0_2_004333BE
Detected potential crypto function
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004096A0 0_2_004096A0
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0042200C 0_2_0042200C
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0041A217 0_2_0041A217
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00412216 0_2_00412216
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0042435D 0_2_0042435D
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004033C0 0_2_004033C0
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044F430 0_2_0044F430
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004125E8 0_2_004125E8
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044663B 0_2_0044663B
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00413801 0_2_00413801
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0042096F 0_2_0042096F
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004129D0 0_2_004129D0
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004119E3 0_2_004119E3
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0041C9AE 0_2_0041C9AE
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0047EA6F 0_2_0047EA6F
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0040FA10 0_2_0040FA10
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044EB5F 0_2_0044EB5F
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00423C81 0_2_00423C81
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00411E78 0_2_00411E78
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00442E0C 0_2_00442E0C
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00420EC0 0_2_00420EC0
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044CF17 0_2_0044CF17
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00444FD2 0_2_00444FD2
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: String function: 00445AE0 appears 65 times
Sample file is different than original file name gathered from version info
Source: 7uJ95NO82G.exe, 00000000.00000002.2543953630.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWINVER.EXE.MUIj% vs 7uJ95NO82G.exe
Source: 7uJ95NO82G.exe, 00000000.00000002.2543926794.0000000003E71000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWINVER.EXE.MUIj% vs 7uJ95NO82G.exe
Uses 32bit PE files
Source: 7uJ95NO82G.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.evad.winEXE@1/1@0/1
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044AF6C GetLastError,FormatMessageW, 0_2_0044AF6C
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 0_2_004333BE
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, 0_2_00464EAE
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode, 0_2_0045D619
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00433EE0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle, 0_2_00433EE0
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize, 0_2_0047839D
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 0_2_0043305F
Source: C:\Users\user\Desktop\7uJ95NO82G.exe File created: C:\Users\user\AppData\Roaming\Windata Jump to behavior
Source: 7uJ95NO82G.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\7uJ95NO82G.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM cookies;
Source: 7uJ95NO82G.exe, 00000000.00000002.2543249546.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM moz_cookies;
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM logins;
Source: 7uJ95NO82G.exe Virustotal: Detection: 66%
Source: 7uJ95NO82G.exe ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\7uJ95NO82G.exe File read: C:\Users\user\Desktop\7uJ95NO82G.exe Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: 7uJ95NO82G.exe Static file information: File size 1136091 > 1048576
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress, 0_2_0040EBD0
PE file contains an invalid checksum
Source: 7uJ95NO82G.exe Static PE information: real checksum: 0xa961f should be: 0x120549
Source: svhost.exe.0.dr Static PE information: real checksum: 0xa961f should be: 0x120549
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00416CB5 push ecx; ret 0_2_00416CC8
Drops PE files
Source: C:\Users\user\Desktop\7uJ95NO82G.exe File created: C:\Users\user\AppData\Roaming\Windata\svhost.exe Jump to dropped file
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_0047A330
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00434418
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Window / User API: threadDelayed 7301 Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Window / User API: foregroundWindowGot 1759 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\7uJ95NO82G.exe API coverage: 5.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\7uJ95NO82G.exe TID: 7744 Thread sleep time: -73010s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Thread sleep count: Count: 7301 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_004339B6
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00452492
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00442886
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_004788BD
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, 0_2_0045CAFA
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00431A86
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 0_2_0044BD27
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045DE8F FindFirstFileW,FindClose, 0_2_0045DE8F
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0044BF8B
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary, 0_2_0040E500
Source: 7uJ95NO82G.exe, 00000000.00000002.2543054037.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: 7uJ95NO82G.exe, 00000000.00000002.2543054037.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\7uJ95NO82G.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0045A370 BlockInput, 0_2_0045A370
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 0_2_0040D590
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress, 0_2_0040EBD0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 0_2_004238DA
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0041F250 SetUnhandledExceptionFilter, 0_2_0041F250
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0041A208
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00417DAA
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00436CD7 LogonUserW, 0_2_00436CD7
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 0_2_0040D590
Contains functionality to query the security center for anti-virus and firewall products
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: winmgmts:\\localhost\root\securitycenter2 memstr_1fab74c7-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hklm64\software\mozilla\mozilla firefox\j memstr_a64e6ca7-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: c:\users\user\desktop\7uj95no82g.exeu memstr_866fe0ba-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: c:\users\user\appdata\roaming\windata3 memstr_b27d93fb-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: c:\users\user~1\appdata\local\temp\sq8.dll> memstr_dfe298de-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: c:\users\user~1\appdata\local\temp\bass.dll) memstr_9b2756f2-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: c:\users\user~1\appdata\local\temp\bacb.dll memstr_2794aa53-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ibottom memstr_af6438e5-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iright memstr_e8191d5c-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rightxx memstr_e091461c-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trect memstr_6c5ac5ae-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trecty memstr_0a171d92-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bottomj memstr_4d35753c-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ibottomq memstr_6958591d-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trectxy memstr_4d9f8eea-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bottom memstr_05c2ecc5-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ileft memstr_26241eb1-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hbitmapw memstr_b39f44ad-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresult memstr_3e41e906-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fcursor memstr_0e1a64e6-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hsocket memstr_cef674a7-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 64array memstr_e983a8ae-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: timeval memstr_4b620969-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: reg_sz memstr_bf01062d-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fd_set memstr_268c15a0-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: longs memstr_f279ffc8-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vallongi memstr_2c0bb47e-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fdcount4 memstr_36cdffa6-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: result, memstr_5cba2c2e-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fdarra memstr_061725b2-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dll32ws memstr_24bde3ae-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: inttcp memstr_89944417-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: selectst memstr_75f27f93-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hsockety memstr_97c3d9bf-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ptrsse memstr_2b7d550d-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ptrssj memstr_7e1bb375-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fd_setl memstr_f010d5d1-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: result memstr_c7d84ae2-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tagrect memstr_fcb44b51-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: result2p memstr_b335b8ea-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dll32wsa memstr_8bb7e231-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hsocketj memstr_4b121be7-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: erroro memstr_d77b654d-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: uint6 memstr_9d0d98f1-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: result2 memstr_9758b2de-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: inttcpg memstr_b093a66b-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isoket memstr_30768ebe-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dll32wsh memstr_6bbe4196-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: struct*9 memstr_c51d6e08-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hsocket/ memstr_9eb650e3-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: logxsd memstr_27896ea6-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vallong memstr_4f719575-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: uint2 memstr_6d32ef3b-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trectg memstr_aa5047a4-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: length memstr_3a8c7945-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vallonge memstr_377439ae-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: eltoul? memstr_8ae0352e-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: length+ memstr_d09d6bc7-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: himage memstr_589d8edf-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sclsid memstr_6c9bbcf9-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sclsid| memstr_9ef02bf6-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: keyddq memstr_26d8746b-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ibottomb memstr_0f14cb81-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fcursoru memstr_68361d47-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iright_ memstr_04b95028-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ilefth memstr_db676f10-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: itop7 memstr_ac0ccf4a-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pathis memstr_79c02648-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hwndw memstr_949d6782-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: longb memstr_f597a7dc-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dword memstr_fdeed309-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hisaa8t memstr_0479e477-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: monshu memstr_cca33a3c-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: struct* memstr_89abbc98-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: key8cc= memstr_2e6245cf-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trect) memstr_667efed7-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bretxu memstr_b7668928-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: key8cc memstr_04ec2b5a-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: right memstr_fcb492e8-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: piqdnc memstr_54364ffc-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dastr memstr_110c6a5b-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bottom{ memstr_814fd604-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trect} memstr_bd432f13-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: errora memstr_43a30f19-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fzdir memstr_e08cbcdf-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: leftc memstr_8bd2f288-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trectj memstr_29649edd-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: win32x memstr_b967ee31-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fzdir2 memstr_5da3db41-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ileft5 memstr_e48b7eef-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: key2x memstr_4c916ac9-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trectp memstr_1c9a0f57-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rightr memstr_f3da5a65-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ibottomw memstr_d3d7b792-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bottomc memstr_c1e9cedb-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trecthv memstr_a945a3ae-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: leftv memstr_270c564a-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ibottom> memstr_a5f58f58-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ileft memstr_403340ff-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: itop(v memstr_aeb28b4c-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: righte memstr_659ae118-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bottomo memstr_1b58f8ac-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fzdir2q memstr_8c202b43-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trect(x memstr_3231c371-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: itop0 memstr_c398d6fb-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iright5 memstr_00361e59-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trect! memstr_26487f5a-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: __sqlite_inline_version memstr_a7d023cc-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: __sqlite_verscmp memstr_c1d569f1-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: select * from logins; memstr_01cbc5e5-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: cryptunprotectdata memstr_7411fa45-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: uncryptrdppassword memstr_0d08b261-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _sqlite_shutdown memstr_ab0a4f07-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _sqlite_gettable2d memstr_a6930c69-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: objantivirusproductb memstr_e8fd978e-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: g_butf8errormsg_sqlite# memstr_d998a0f5-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: g_sprintcallback_sqlite- memstr_672f6252-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: select * from cookies; memstr_23948596-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: g_sprintcallback_sqlite memstr_acdceff3-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: __sqlite_verscmpersion memstr_fa6fdd04-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _replacestringinfile memstr_ad95781c-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _screencapture_capture memstr_08b55ebb-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: getasynckeystate memstr_18f4466a-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _winapi_getwindowrect memstr_05a51082-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tcpevent_disconnect memstr_8c61e4ca-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: proxyclient_start memstr_28f3af47-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _arrayconcatenate memstr_3cc3109e-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _filelisttoarraypture memstr_387f7911-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: proxyclient_start memstr_f4c05173-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _screencapture_captureg memstr_d9cacad9-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tcpevent_disconnecth memstr_b72ad2c5-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dwmgetwindowattributeq memstr_c339fdd1-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tcpevent_disconnectc memstr_ccb81f47-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ptr;ptr;short;short;ptr6 memstr_b9f9df21-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tcpevent_disconnect? memstr_25095bdf-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shell.application memstr_e4becf12-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: objantivirusproduct memstr_1c45755f-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _ispressedts memstr_bd7b06ca-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: user32.dll memstr_8aea64a0-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: user32.dlleate memstr_dee46929-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: getwindowrect memstr_32ce5e21-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: extendedose memstr_f894e527-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: monitorgrabbere memstr_8599029c-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: usernamexpv memstr_9670c970-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverriby memstr_2b6c8457-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever\ memstr_23293554-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverg memstr_6ab2adb7-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: /(click sm memstr_3d0d42a6-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: extended! memstr_b19a14de-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _ispressed/ memstr_5f3b43b5-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: /(click s memstr_bb8ae79e-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: monitorxtitg memstr_1dbf2e4f-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: usernametring memstr_03f0f9f3-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: monitorxtitt memstr_2889e85b-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever memstr_79862bb2-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverr memstr_4e9b23b8-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreveru memstr_a9a0dd90-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverx memstr_84757269-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverc memstr_ba686096-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverf memstr_aa58f610-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreveri memstr_e4990834-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverl memstr_01583baa-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: proxy_dllw memstr_47375f5b-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverz memstr_cd717c3e-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever] memstr_553afcf4-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever@ memstr_7e678212-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugreverk memstr_87b85cc1-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrevern memstr_5d61ca26-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever1 memstr_a7dd388b-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever4 memstr_6c17c5d5-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever? memstr_19467235-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever" memstr_8551d214-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever% memstr_d85ad10c-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plugrever( memstr_1743a4c6-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: client_ip memstr_93582f4d-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraysource memstr_44163231-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraytarget memstr_08fcc5d0-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shell32.dll memstr_8414b789-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsource memstr_fb4d955a-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundtarget memstr_8f76a29e-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsource0 memstr_f5a5b1b1-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraysourcev memstr_00a82257-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hdll_ws2_32y memstr_5da29ab3-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _fileprint| memstr_4e0a25a3-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsourceg memstr_53fae884-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsourcej memstr_d2a8d1f8-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraysourcem memstr_cb09203a-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraytarget[ memstr_37fb4b66-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shellexecutew^ memstr_0918a837-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: extendeda memstr_d9a8f08c-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraysourceo memstr_fc6db689-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraytarget5 memstr_744869d9-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avarraytarget8 memstr_b9a66bfe-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _tcpiptoname# memstr_80aaa7f3-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: client_ip& memstr_e90bca3d-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundtarget, memstr_a6228369-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vadllcallerror memstr_48c80a0c-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vadllcall memstr_018c2e41-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hdll_ws2_32 memstr_999a7784-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: wsagetlasterror memstr_cb158d8f-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shostnameseate memstr_6fbd03d3-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: inaddr_none memstr_481f4110-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vhostent memstr_aea5c719-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: gethostbyaddr memstr_7aaf08ef-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vptrhostent memstr_c8d82693-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shostnames memstr_c4f5e369-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sseparator memstr_5d3eb074-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ws2_32.dll memstr_6ef21050-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vh_aliaseseate memstr_9f255858-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vh_aliases memstr_567a7359-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: inet_addr memstr_c903b6fe-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hdll_ws2_32r memstr_7f6a12b2-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sendswithw memstr_e671090b-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_totfilepcrz memstr_9f033a48-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ulong_ptr:cdecl} memstr_246dc143-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_totfilek memstr_2771d55e-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: afilelinesn memstr_53db6571-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iencodingpcrq memstr_5906c418-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_totfilet memstr_9e70365f-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vszstringpws_ memstr_320d1496-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szfilenameb memstr_60dc9057-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szreplacestringe memstr_8882a11d-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: foccuranceringh memstr_e10973df-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sendswithrng3 memstr_0a03fe4b-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shostnames6 memstr_2e05bb5c-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vhostent9 memstr_28f908d5-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vh_aliases< memstr_ab1b5c06-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shostnames' memstr_9d42e3a6-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: msvcrt.dll* memstr_2a6c3960-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vh_aliases- memstr_d5633189-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vszstring memstr_8c2dcced-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fcaseness memstr_c5986cb7-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szfilename memstr_632480a6-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vszstringd memstr_2cc85530-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sendswith memstr_1b680391-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_totfileribe memstr_0715b36e-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szfilenameib memstr_e512158d-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szsearchstring memstr_fa0e01b2-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sendswithtate memstr_278f0709-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: oishelldispatch memstr_e4f3a16f-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hwritehandle memstr_521a124f-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fcasenessle memstr_c001b273-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szreplacestring memstr_dbbb0eab-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: foccurance memstr_27db8cca-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: afilelines memstr_1330796c-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szfilenameding memstr_0389eb9f-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fo_overwrite memstr_1000a1a3-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iencoding memstr_383655c3-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sendswithtring memstr_37b7f9c3-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ishowflag memstr_1c664ebf-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: owebbrowser memstr_06c58d68-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: afilelinesp memstr_e88f792b-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: afilelines{ memstr_eb333469-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: afilelines~ memstr_653e3928-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sw_shownormald memstr_d9e0193e-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hwritehandler memstr_44cfb827-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: afilelinesu memstr_0569c9bf-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: foccurancex memstr_d0159997-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szfilenamec memstr_b7014e1b-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: afilelinesingf memstr_3abdaecf-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: szsearchstringi memstr_d0379879-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fcasenesstel memstr_1bdc228f-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avstatus8: memstr_24485f9d-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: osversion= memstr_7bbb2158-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ishowflag memstr_b1ab78e1-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: documentspatch+ memstr_94281326-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: findwindowsw. memstr_edc9a4d9-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _(xp|200(0|3)) memstr_9d985c5c-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: displayname memstr_ac9881b1-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: application memstr_ac052a01-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: colitems memstr_f18b3f83-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avstatus8 memstr_87c712b3-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avstatus8te memstr_29f55075-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shellexecute memstr_24e12eb1-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: extended memstr_57b72212-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: execquerypatch memstr_21959f98-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: productstate memstr_4006886d-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx1 memstr_6b352c80-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: resbulkx memstr_1f0a3b9a-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icolumnsx1q memstr_6be1a5ed-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx1t memstr_26e96d28-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: checkdllb memstr_16aa653b-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx1h memstr_2b5cb7a7-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _sqlite_openv memstr_2bfed217-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icolumnsx1\ memstr_b1b5f538-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx1g memstr_cd4c35ca-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx1j memstr_84a753ea-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpath2; memstr_99cc397f-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ssqlitedll> memstr_66b9ad1e-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpath2! memstr_1e913e4c-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \dbsq2.db$ memstr_737b21a1-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpath2artup/ memstr_45b09424-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _sqlite_startup memstr_08c0010e-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx1en memstr_64c1ecec-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpath2 memstr_995977dc-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sqlite_ok memstr_0b514a20-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: disabled memstr_edd39f6a-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx memstr_d8303d01-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: spathdata memstr_720ec009-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: yyrtrreeaa memstr_63f3f269-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpathmright memstr_ef142569-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: logdoxets memstr_565aaa7c-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpaths memstr_bcb66d66-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icolumnsx memstr_86f112cb-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sqlite_okartup memstr_d1643b56-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpath memstr_f5ba5447-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: chromeoprera memstr_2ca02a25-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: checkdll memstr_576035a7-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _sqlite_close memstr_74cbc201-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \dbsq.db memstr_eb88269a-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ssqlitedllr memstr_2292e50d-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _sqlite_openu memstr_6f4a9fa7-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: realpathlosex memstr_3522694a-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultxc memstr_4456e8cc-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icolumnsxf memstr_3db83b96-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultxel memstr_fc284b99-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ielementcreatew memstr_29a8f827-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx] memstr_4d4ad590-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: data_blobk memstr_46be71c3-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pwdescriptionen memstr_30bea3e0-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ielementetete1 memstr_87291a56-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: data_blob4 memstr_621d56e5-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ielementtring? memstr_ca11b680-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: aresultx% memstr_ef0e5135-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _sqlite_close( memstr_bbd45262-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: data_blob memstr_8385c688-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _arraydeletetr memstr_898ca837-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ielementcreate memstr_cba668f0-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: stealdonex memstr_7e56d3fa-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: checkdlllose memstr_4aad5022-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ssqlitedll memstr_d7120387-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: byte[1024] memstr_5c096eb9-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: crypt32.dllptr memstr_34eff1fb-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ielementtring memstr_6b4e0424-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ielement memstr_50b31918-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomptype memstr_6e906652-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomptypeop memstr_fa31c41d-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsub memstr_9b2c0d0f-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icompare memstr_0176dd8b-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isubitemoop memstr_a2619c45-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _tempfiler memstr_a4b0b974-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isubitem memstr_851ce6a2-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_fileprefixme memstr_025c6e6e-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _arraysearch memstr_9a54eff6-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_directoryname memstr_84b1d00a-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: scriptdirynames memstr_42263307-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomparev memstr_8a01cb96-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iforwardy memstr_0f75521a-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomptype| memstr_8f19e770-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iforwardg memstr_5767c1ff-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomparej memstr_f28a27da-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isubitemm memstr_640e2549-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomptypep memstr_5f464b10-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsubp^ memstr_547282df-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isubitema memstr_bc61fe9c-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomptyped memstr_2fc88d56-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isubitemo memstr_8b45fed7-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsub2 memstr_083dc4c7-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icomptypech5 memstr_119328ce-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iuboundsub8 memstr_083dddc2-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isubitem# memstr_1828d6ae-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icompare& memstr_8ff81ce7-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isubiteme, memstr_4709b305-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_tempname memstr_cedde5ee-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: i_randomlength memstr_3a9b6230-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_tempnamename memstr_f6b832e8-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_tempnamegth memstr_b17a56dd-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_fileprefix memstr_602ee54a-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_fileextension memstr_2419000a-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: stextzwv memstr_e82ffe6c-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: regdat[ memstr_3851ce96-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: firx< memstr_eea4199a-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: stextzw memstr_697b8624-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: seconx" memstr_c5812fef-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: firx$ memstr_4792d66f-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: seconx memstr_8f7083cb-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ffzete memstr_b9232d2f-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hisaa memstr_6cec3216-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: key8cc] memstr_5acd4a2d-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ssaevv: memstr_be2453ac-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pidx? memstr_0bfc91fc-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: mgxcli memstr_6bfa31cc-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: beginxc memstr_87a5cb9d-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fddsf43 memstr_4a1c78b9-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: mdayh memstr_f3a83b5c-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: actwh memstr_efdf9b90-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: mday* memstr_045e564e-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ssaevv memstr_f920ecc5-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vicname memstr_5e03db4b-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icallx memstr_f72fc59e-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ncount memstr_9f15f103-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ffzeten memstr_77664a70-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: s_file memstr_49d2d3fe-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vicname+ memstr_e41f4d5a-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: seconx( memstr_e0c42e55-3
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: i_show memstr_62239eb8-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ushort memstr_32d906ae-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shexkey_ memstr_b47ce0d2-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: error* memstr_c9818dc0-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: short memstr_217104f4-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: shexkey memstr_d4f630aa-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hisaag memstr_613273d2-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: icall8 memstr_a88f8536-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543620760.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: plurevb memstr_95232468-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bbjnnnn memstr_a4305dc7-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ipsc2 memstr_f3ed8a60-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vvahk memstr_09f252f5-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _getav memstr_e03aa9df-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: monopris memstr_c87b9f00-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: winstaxp memstr_293dfde9-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: logpathz memstr_dbee88bc-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: win_8x memstr_889c752a-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fo_read memstr_7e07c39c-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: swhide memstr_27d072e4-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tagguid memstr_4aac3007-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tagrect memstr_bb4a7bf9-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tempdirt memstr_320c7f02-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vatytyl memstr_7e704e98-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fzhhet] memstr_58ab2a62-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fazeyfeb memstr_0cbc059f-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ffazezsd memstr_9553054b-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fvffs0 memstr_5f752ff5-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hgazdd: memstr_94e1f2e7-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: yyzadc+ memstr_ec491ab9-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pi20p memstr_eddc97b9-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: schrome memstr_2315f973-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sopera memstr_0706b1ce-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tgztret memstr_f8eaba6e-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: yyzerf memstr_6c8efeb4-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: longs memstr_83617cff-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 64array memstr_afcb9e7b-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: baench memstr_ffb7963f-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fdarraw memstr_4c0d010d-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: logxsdy memstr_d3d0d5c9-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fdcountc memstr_7473e9d2-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dll32wso memstr_7a62d294-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: selects= memstr_9cf57576-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ptrss. memstr_9a392055-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: uint2 memstr_3aba9f8d-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: isoket memstr_0358690f-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: inttcp memstr_955ee0dd-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: eltoul memstr_d2bd541a-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bssetty memstr_f1a1dffa-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: basst{ memstr_e7b53c72-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hophx_ memstr_1d9b1e95-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: uaxw( memstr_2c28ae85-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: camexi memstr_67921bcb-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sousne memstr_76afe3bd-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vvytre memstr_0cac9d03-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: lodr( memstr_eac41b87-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: webs8 memstr_e45da788-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: certyu memstr_3c566cfa-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 8dsd8s memstr_d7e039e4-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bejdshd memstr_84fad85c-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: p12ccv1w memstr_ba4e658b-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: srtttty[ memstr_8c268462-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: msssxd memstr_abb2e297-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: strs5 memstr_07c79518-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fasil? memstr_540c32d1-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: lpard memstr_5e8de92f-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: scodep memstr_056c3622-2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: wpdsd memstr_4340674e-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: jpxd0 memstr_74357fb1-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: lfert memstr_a5dd9fd0-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: nejma memstr_6ec6b32d-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pathis memstr_3fdded09-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fftzzz memstr_72244e7c-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: phtisax memstr_9cae5556-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: cert8 memstr_6ee34787-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dirfoxs memstr_29fc09e4-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pacthwau memstr_dd78f26e-d
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: svw2z memstr_00520b7c-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: souxc memstr_df9acbbd-6
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dlclieh memstr_74f992e5-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: screen; memstr_8f9f5ffe-0
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: escupx memstr_60c3037d-9
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ccwa1 memstr_6c26a99f-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: thisav memstr_050b1f3f-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: recivt memstr_3795a57c-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ngdfgrt memstr_cf1397fe-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bbdfdfp memstr_ff495292-a
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dexcz memstr_8fdf99be-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vicname memstr_e1ec63ae-8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: win32x memstr_d1d40317-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1666ss memstr_520184b3-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1666h memstr_4d7b8b2e-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: qlits8 memstr_b290f1e4-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: thisav2u memstr_158d56d2-7
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: camx_ memstr_f4771595-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: resxox memstr_89740420-f
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: archx9 memstr_8b3128f5-4
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ddaa( memstr_b8b12cfc-b
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ddfdzty memstr_20831861-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: mouxc memstr_fce925a4-e
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: actqus memstr_66006de0-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: usecc memstr_c3a1aebb-1
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tooor83 memstr_fa286c83-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: porsd memstr_b8610672-c
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: uuxxx memstr_1f02e8a6-5
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: x2x2x2 memstr_e1727302-e
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00434418
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event, 0_2_0043333C
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_00446124
Source: 7uJ95NO82G.exe Binary or memory string: Shell_TrayWnd
Source: 7uJ95NO82G.exe, 00000000.00000002.2543249546.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Class:Shell_TrayWnd]
Source: 7uJ95NO82G.exe, svhost.exe.0.dr Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW, 0_2_004720DB
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00472C3F GetUserNameW, 0_2_00472C3F
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte, 0_2_0041E364
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary, 0_2_0040E500
AV process strings found (often used to terminate AV products)
Source: 7uJ95NO82G.exe, 00000000.00000002.2543054037.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, 7uJ95NO82G.exe, 00000000.00000002.2543054037.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LodaRAT
Source: Yara match File source: Process Memory Space: 7uJ95NO82G.exe PID: 7740, type: MEMORYSTR
OS version to string mapping found (often used in BOTs)
Source: 7uJ95NO82G.exe, 00000000.00000002.2543249546.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WIN_XP
Source: svhost.exe.0.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: 7uJ95NO82G.exe, 00000000.00000002.2543249546.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WIN_XPe
Source: 7uJ95NO82G.exe Binary or memory string: WIN_VISTA
Source: 7uJ95NO82G.exe Binary or memory string: WIN_7
Source: 7uJ95NO82G.exe Binary or memory string: WIN_8
Source: 7uJ95NO82G.exe, 00000000.00000002.2543249546.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WIN_VISTA2
Source: 7uJ95NO82G.exe, 00000000.00000002.2543906248.0000000003E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WIN_8x
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: 7uJ95NO82G.exe PID: 7740, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LodaRAT
Source: Yara match File source: Process Memory Space: 7uJ95NO82G.exe PID: 7740, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, 0_2_0046CEF3
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 0_2_004652BE
Source: C:\Users\user\Desktop\7uJ95NO82G.exe Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_00476619
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580278 Sample: 7uJ95NO82G.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 100 13 Suricata IDS alerts for network traffic 2->13 15 Antivirus detection for dropped file 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 6 other signatures 2->19 5 7uJ95NO82G.exe 2 2->5         started        process3 dnsIp4 11 172.232.216.250, 4000, 49751, 49801 AKAMAI-ASN1EU United States 5->11 9 C:\Users\user\AppData\Roaming\...\svhost.exe, PE32 5->9 dropped file5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.232.216.250
 unknown United States
20940 AKAMAI-ASN1EU true