Edit tour

Windows Analysis Report
25F.tmp.exe

Overview

General Information

Sample name:	25F.tmp.exe
Analysis ID:	1582673
MD5:	348ad3e983cccbab62c3648f0bcb0f88
SHA1:	ba39729ea26b32aee01b4dc57e89f7a909bda3b2
SHA256:	9d8445fe53e5494a49bc714ef07ce39b41ad71ea7de73699f0b28bef16bb9da8
Infos:

Detection

Darkbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (creates a PE file in dynamic memory)

Yara detected Darkbot

AI detected suspicious sample

Allocates memory in foreign processes

Changes memory attributes in foreign processes to executable or writable

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after checking system information)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Changes the start page of internet explorer

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to get notified if a device is plugged in / out

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w7x64

25F.tmp.exe (PID: 3252 cmdline: "C:\Users\user\Desktop\25F.tmp.exe" MD5: 348AD3E983CCCBAB62C3648F0BCB0F88)

25F.tmp.exe (PID: 3356 cmdline: C:\Users\user\Desktop\25F.tmp.exe MD5: 348AD3E983CCCBAB62C3648F0BCB0F88)

notepad.exe (PID: 3372 cmdline: "C:\Windows\notepad.exe" MD5: B32189BDFF6E577A92BAA61AD49264E6)

25F.tmp.exe (PID: 3380 cmdline: C:\Users\user\Desktop\25F.tmp.exe MD5: 348AD3E983CCCBAB62C3648F0BCB0F88)

iexplore.exe (PID: 3396 cmdline: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" MD5: 8A590F790A98F3D77399BE457E01386A)

iexplore.exe (PID: 3408 cmdline: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" MD5: 4EB098135821348270F27157F7A84E65)

iexplore.exe (PID: 3700 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:275457 /prefetch:2 MD5: 8A590F790A98F3D77399BE457E01386A)

WmiPrvSE.exe (PID: 652 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 54B7C43C2E89F5CE71B2C255C1CF35E2)

QgGhoOpxHPl.exe (PID: 2384 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1440 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2096 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1804 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 892 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1968 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 172 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 492 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1784 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1396 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 816 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1012 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1668 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2836 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1756 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2672 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2708 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2704 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2868 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 3068 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2684 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2688 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1436 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1452 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1060 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2248 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1448 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 2228 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1260 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 1852 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 724 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

QgGhoOpxHPl.exe (PID: 772 cmdline: "C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: 25F.tmp.exe PID: 3356	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: 25F.tmp.exe PID: 3380	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 652	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2384	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1440	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2096	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1804	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 892	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1968	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 172	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 492	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1784	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1396	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 816	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1012	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1668	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2836	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1756	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2672	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2708	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2704	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2868	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 3068	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2684	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2688	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1436	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1452	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1060	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2248	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1448	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 2228	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1260	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 1852	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 724	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Process Memory Space: QgGhoOpxHPl.exe PID: 772	JoeSecurity_Darkbot	Yara detected Darkbot	Joe Security
Click to see the 30 entries

Sigma Signatures

System Summary

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 3408, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 25F.tmp.exe

Avira: detected

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.9% probability

Machine Learning detection for sample

Source: 25F.tmp.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00361EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	4_2_00361EA0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00368C90 memset,WSAGetLastError,DecryptMessage,	4_2_00368C90
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00368B30 memset,EncryptMessage,	4_2_00368B30
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00408C90 memset,WSAGetLastError,DecryptMessage,	4_2_00408C90
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00401EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	4_2_00401EA0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00408B30 memset,EncryptMessage,	4_2_00408B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	9_2_003D1EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D8C90 memset,WSAGetLastError,DecryptMessage,	9_2_003D8C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D8B30 memset,EncryptMessage,	9_2_003D8B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_00188C90 memset,WSAGetLastError,DecryptMessage,	10_2_00188C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_00181EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	10_2_00181EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_00188B30 memset,EncryptMessage,	10_2_00188B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_00381EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	11_2_00381EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_00388C90 memset,WSAGetLastError,DecryptMessage,	11_2_00388C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_00388B30 memset,EncryptMessage,	11_2_00388B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_00418C90 memset,WSAGetLastError,DecryptMessage,	12_2_00418C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_00411EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	12_2_00411EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_00418B30 memset,EncryptMessage,	12_2_00418B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B8C90 memset,WSAGetLastError,DecryptMessage,	13_2_001B8C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	13_2_001B1EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B8B30 memset,EncryptMessage,	13_2_001B8B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_00351EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	14_2_00351EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_00358C90 memset,WSAGetLastError,DecryptMessage,	14_2_00358C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_00358B30 memset,EncryptMessage,	14_2_00358B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_00311EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	15_2_00311EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_00318C90 memset,WSAGetLastError,DecryptMessage,	15_2_00318C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_00318B30 memset,EncryptMessage,	15_2_00318B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_00381EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	16_2_00381EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_00388C90 memset,WSAGetLastError,DecryptMessage,	16_2_00388C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_00388B30 memset,EncryptMessage,	16_2_00388B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_00108C90 memset,WSAGetLastError,DecryptMessage,	17_2_00108C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_00101EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	17_2_00101EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_00108B30 memset,EncryptMessage,	17_2_00108B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_00108C90 memset,WSAGetLastError,DecryptMessage,	18_2_00108C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_00101EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	18_2_00101EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_00108B30 memset,EncryptMessage,	18_2_00108B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_00221EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	19_2_00221EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_00228C90 memset,WSAGetLastError,DecryptMessage,	19_2_00228C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_00228B30 memset,EncryptMessage,	19_2_00228B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_00321EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	20_2_00321EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_00328C90 memset,WSAGetLastError,DecryptMessage,	20_2_00328C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_00328B30 memset,EncryptMessage,	20_2_00328B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_00518C90 memset,WSAGetLastError,DecryptMessage,	21_2_00518C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_00511EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	21_2_00511EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_00518B30 memset,EncryptMessage,	21_2_00518B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_00198C90 memset,WSAGetLastError,DecryptMessage,	22_2_00198C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_00191EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	22_2_00191EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_00198B30 memset,EncryptMessage,	22_2_00198B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_00848C90 memset,WSAGetLastError,DecryptMessage,	23_2_00848C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_00841EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	23_2_00841EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_00848B30 memset,EncryptMessage,	23_2_00848B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_00408C90 memset,WSAGetLastError,DecryptMessage,	25_2_00408C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_00401EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	25_2_00401EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_00408B30 memset,EncryptMessage,	25_2_00408B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_00828C90 memset,WSAGetLastError,DecryptMessage,	26_2_00828C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_00821EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	26_2_00821EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_00828B30 memset,EncryptMessage,	26_2_00828B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_00098C90 memset,WSAGetLastError,DecryptMessage,	27_2_00098C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_00091EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	27_2_00091EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_00098B30 memset,EncryptMessage,	27_2_00098B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D8C90 memset,WSAGetLastError,DecryptMessage,	29_2_005D8C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	29_2_005D1EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D8B30 memset,EncryptMessage,	29_2_005D8B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_00098C90 memset,WSAGetLastError,DecryptMessage,	30_2_00098C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_00091EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	30_2_00091EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_00098B30 memset,EncryptMessage,	30_2_00098B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_00918C90 memset,WSAGetLastError,DecryptMessage,	31_2_00918C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_00911EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	31_2_00911EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_00918B30 memset,EncryptMessage,	31_2_00918B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_00391EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	32_2_00391EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_00398C90 memset,WSAGetLastError,DecryptMessage,	32_2_00398C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_00398B30 memset,EncryptMessage,	32_2_00398B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_00098C90 memset,WSAGetLastError,DecryptMessage,	33_2_00098C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_00091EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	33_2_00091EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_00098B30 memset,EncryptMessage,	33_2_00098B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_00221EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	34_2_00221EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_00228C90 memset,WSAGetLastError,DecryptMessage,	34_2_00228C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_00228B30 memset,EncryptMessage,	34_2_00228B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_00158C90 memset,WSAGetLastError,DecryptMessage,	35_2_00158C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_00151EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	35_2_00151EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_00158B30 memset,EncryptMessage,	35_2_00158B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	36_2_007F1EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F8C90 memset,WSAGetLastError,DecryptMessage,	36_2_007F8C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F8B30 memset,EncryptMessage,	36_2_007F8B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_00251EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	37_2_00251EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_00258C90 memset,WSAGetLastError,DecryptMessage,	37_2_00258C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_00258B30 memset,EncryptMessage,	37_2_00258B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_00261EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	38_2_00261EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_00268C90 memset,WSAGetLastError,DecryptMessage,	38_2_00268C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_00268B30 memset,EncryptMessage,	38_2_00268B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	39_2_003F1EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F8C90 memset,WSAGetLastError,DecryptMessage,	39_2_003F8C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F8B30 memset,EncryptMessage,	39_2_003F8B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F1EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	40_2_003F1EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F8C90 memset,WSAGetLastError,DecryptMessage,	40_2_003F8C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F8B30 memset,EncryptMessage,	40_2_003F8B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_00281EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	41_2_00281EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_00288C90 memset,WSAGetLastError,DecryptMessage,	41_2_00288C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_00288B30 memset,EncryptMessage,	41_2_00288B30
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_00108C90 memset,WSAGetLastError,DecryptMessage,	42_2_00108C90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_00101EA0 CreateFileW,GetLastError,CryptAcquireContextA,GetLastError,CloseHandle,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CloseHandle,GetLastError,	42_2_00101EA0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_00108B30 memset,EncryptMessage,	42_2_00108B30

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\25F.tmp.exe	Unpacked PE file: 2.2.25F.tmp.exe.400000.0.unpack
Source: C:\Users\user\Desktop\25F.tmp.exe	Unpacked PE file: 4.2.25F.tmp.exe.360000.0.unpack
Source: C:\Users\user\Desktop\25F.tmp.exe	Unpacked PE file: 4.2.25F.tmp.exe.400000.1.unpack

Source: 25F.tmp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.18.38:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.18.38:443 -> 192.168.2.22:49174 version: TLS 1.2

Source:

Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: QgGhoOpxHPl.exe, 00000009.00000002.624007678.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000000A.00000002.623894475.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000000B.00000002.624028617.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000000C.00000002.624002687.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000000D.00000002.623566344.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000000E.00000002.624079839.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000000F.00000002.623632104.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000010.00000002.623656498.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000011.00000000.386197187.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000012.00000002.623647954.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000013.00000002.623981000.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000014.00000000.387583156.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000015.00000002.623920086.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000016.00000002.623820405.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000017.00000000.391050949.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000019.00000002.623538208.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000001A.00000000.391969074.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000001B.00000000.392217468.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000001D.00000000.392771743.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000001E.00000002.623775125.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 0000001F.00000000.393702318.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000020.00000000.394071706.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000021.00000000.394366434.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000022.00000000.394702338.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000023.00000000.394946970.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000024.00000000.395128308.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000025.00000002.623951188.000000000123E000.00000002.00000001.01000000.00000005.sdmp, QgGhoOpxHPl.exe, 00000026.00000000.395491250.000000000123E000.00000002.00000001.01000000.00000005.sdmp, Qg

Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe

Code function: 10_2_0018FB60 RegisterClassExA,CreateWindowExA,RegisterDeviceNotificationA,GetMessageA,GetMessageA,TranslateMessage,TranslateMessage,DispatchMessageA,GetMessageA,

10_2_0018FB60

Source: 25F.tmp.exe, 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: 25F.tmp.exe, 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: 25F.tmp.exe, 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: 25F.tmp.exe, 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: 25F.tmp.exe, 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: 25F.tmp.exe	Binary or memory string: %sautorun.inf
Source: 25F.tmp.exe	Binary or memory string: [autorun]
Source: 25F.tmp.exe	Binary or memory string: autorun.inf
Source: 25F.tmp.exe, 00000004.00000003.399212621.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: 25F.tmp.exe, 00000004.00000003.399212621.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: 25F.tmp.exe, 00000004.00000003.399212621.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: 25F.tmp.exe, 00000004.00000003.399212621.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: 25F.tmp.exe, 00000004.00000003.399212621.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: 25F.tmp.exe, 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: 25F.tmp.exe, 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: 25F.tmp.exe, 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: 25F.tmp.exe, 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: 25F.tmp.exe, 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: 25F.tmp.exe, 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: 25F.tmp.exe, 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: 25F.tmp.exe, 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: 25F.tmp.exe, 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: 25F.tmp.exe, 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: WmiPrvSE.exe, 00000008.00000003.383827255.0000000000C50000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: WmiPrvSE.exe, 00000008.00000003.383827255.0000000000C50000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: WmiPrvSE.exe, 00000008.00000003.383827255.0000000000C50000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: WmiPrvSE.exe, 00000008.00000003.383827255.0000000000C50000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: WmiPrvSE.exe, 00000008.00000003.383827255.0000000000C50000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000000A.00000002.620519404.0000000000180000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000000A.00000002.620519404.0000000000180000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000000A.00000002.620519404.0000000000180000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000000A.00000002.620519404.0000000000180000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000000A.00000002.620519404.0000000000180000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000000B.00000002.620993011.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000000B.00000002.620993011.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000000B.00000002.620993011.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000000B.00000002.620993011.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000000B.00000002.620993011.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000000C.00000002.621009440.0000000000410000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000000C.00000002.621009440.0000000000410000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000000C.00000002.621009440.0000000000410000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000000C.00000002.621009440.0000000000410000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000000C.00000002.621009440.0000000000410000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000000D.00000002.620504117.00000000001B0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000000D.00000002.620504117.00000000001B0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000000D.00000002.620504117.00000000001B0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000000D.00000002.620504117.00000000001B0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000000D.00000002.620504117.00000000001B0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000000E.00000002.620850418.0000000000350000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000000E.00000002.620850418.0000000000350000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000000E.00000002.620850418.0000000000350000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000000E.00000002.620850418.0000000000350000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000000E.00000002.620850418.0000000000350000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000000F.00000002.620690942.0000000000310000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000000F.00000002.620690942.0000000000310000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000000F.00000002.620690942.0000000000310000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000000F.00000002.620690942.0000000000310000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000000F.00000002.620690942.0000000000310000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000010.00000002.621074931.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000010.00000002.621074931.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000010.00000002.621074931.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000010.00000002.621074931.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000010.00000002.621074931.0000000000380000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000011.00000002.620453836.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000011.00000002.620453836.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000011.00000002.620453836.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000011.00000002.620453836.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000011.00000002.620453836.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000012.00000002.620425856.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000012.00000002.620425856.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000012.00000002.620425856.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000012.00000002.620425856.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000012.00000002.620425856.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000013.00000002.620940422.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000013.00000002.620940422.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000013.00000002.620940422.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000013.00000002.620940422.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000013.00000002.620940422.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000014.00000002.621011349.0000000000320000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000014.00000002.621011349.0000000000320000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000014.00000002.621011349.0000000000320000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000014.00000002.621011349.0000000000320000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000014.00000002.621011349.0000000000320000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000015.00000002.621699118.0000000000510000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000015.00000002.621699118.0000000000510000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000015.00000002.621699118.0000000000510000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000015.00000002.621699118.0000000000510000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000015.00000002.621699118.0000000000510000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000016.00000002.620637334.0000000000190000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000016.00000002.620637334.0000000000190000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000016.00000002.620637334.0000000000190000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000016.00000002.620637334.0000000000190000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000016.00000002.620637334.0000000000190000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000017.00000002.621698802.0000000000840000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000017.00000002.621698802.0000000000840000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000017.00000002.621698802.0000000000840000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000017.00000002.621698802.0000000000840000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000017.00000002.621698802.0000000000840000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000019.00000002.621359929.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000019.00000002.621359929.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000019.00000002.621359929.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000019.00000002.621359929.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000019.00000002.621359929.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000001A.00000002.621684132.0000000000820000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000001A.00000002.621684132.0000000000820000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000001A.00000002.621684132.0000000000820000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000001A.00000002.621684132.0000000000820000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000001A.00000002.621684132.0000000000820000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000001B.00000002.620411571.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000001B.00000002.620411571.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000001B.00000002.620411571.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000001B.00000002.620411571.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000001B.00000002.620411571.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000001D.00000002.621517532.00000000005D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000001D.00000002.621517532.00000000005D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000001D.00000002.621517532.00000000005D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000001D.00000002.621517532.00000000005D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000001D.00000002.621517532.00000000005D0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000001E.00000002.620410172.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000001E.00000002.620410172.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000001E.00000002.620410172.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000001E.00000002.620410172.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000001E.00000002.620410172.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000001F.00000002.622442633.0000000000910000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000001F.00000002.622442633.0000000000910000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000001F.00000002.622442633.0000000000910000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000001F.00000002.622442633.0000000000910000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000001F.00000002.622442633.0000000000910000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000020.00000002.621089259.0000000000390000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000020.00000002.621089259.0000000000390000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000020.00000002.621089259.0000000000390000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000020.00000002.621089259.0000000000390000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000020.00000002.621089259.0000000000390000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000021.00000002.620364062.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000021.00000002.620364062.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000021.00000002.620364062.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000021.00000002.620364062.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000021.00000002.620364062.0000000000090000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000022.00000002.620590554.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000022.00000002.620590554.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000022.00000002.620590554.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000022.00000002.620590554.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000022.00000002.620590554.0000000000220000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000023.00000002.620504431.0000000000150000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000023.00000002.620504431.0000000000150000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000023.00000002.620504431.0000000000150000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000023.00000002.620504431.0000000000150000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000023.00000002.620504431.0000000000150000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000024.00000002.621653908.00000000007F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000024.00000002.621653908.00000000007F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000024.00000002.621653908.00000000007F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000024.00000002.621653908.00000000007F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000024.00000002.621653908.00000000007F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000025.00000002.620568966.0000000000250000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000025.00000002.620568966.0000000000250000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000025.00000002.620568966.0000000000250000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000025.00000002.620568966.0000000000250000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000025.00000002.620568966.0000000000250000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000026.00000002.620636229.0000000000260000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000026.00000002.620636229.0000000000260000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000026.00000002.620636229.0000000000260000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000026.00000002.620636229.0000000000260000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000026.00000002.620636229.0000000000260000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000027.00000002.621284956.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000027.00000002.621284956.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000027.00000002.621284956.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000027.00000002.621284956.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000027.00000002.621284956.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000028.00000002.621275200.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000028.00000002.621275200.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000028.00000002.621275200.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000028.00000002.621275200.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000028.00000002.621275200.00000000003F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 00000029.00000002.620984806.0000000000280000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 00000029.00000002.620984806.0000000000280000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 00000029.00000002.620984806.0000000000280000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 00000029.00000002.620984806.0000000000280000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 00000029.00000002.620984806.0000000000280000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d
Source: QgGhoOpxHPl.exe	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe	Binary or memory string: autorun.inf
Source: QgGhoOpxHPl.exe, 0000002A.00000002.620410514.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: QgGhoOpxHPl.exe, 0000002A.00000002.620410514.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: %sautorun.inf
Source: QgGhoOpxHPl.exe, 0000002A.00000002.620410514.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: NtFreeVirtualMemoryNtAllocateVirtualMemoryNtQuerySystemInformationLdrEnumerateLoadedModulesNtQueryInformationProcessLdrGetProcedureAddressNtQueryVirtualMemoryLdrLoadDllNtQueryInformationThreadLdrGetDllHandleRtlAnsiStringToUnicodeStringntdll.dll\\.\pipe\%skernel32.dllGetNativeSystemInfo%s_%d%s_0-%sMutexSeDebugPrivilegentdll.dllNtGetNextProcess%s-pid%s-commNtResumeThreadInternet Explorer\iexplore.exePONG JOIN #PRIVMSG #%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!.exeautorun.inf%s.Detected process "%S" sending an IRC packet to server %s:%d.%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).PRIVMSG %255sJOIN %255sPRIVMSGJOINcnc%s:%dpidgin.exewlcomm.exemsnmsgr.exemsmsgs.exeflock.exeopera.exechrome.exeieuser.exeiexplore.exefirefox.exeNtSetInformationProcess&%s.%s%s%S%s%sHKCU\HKLM\%s.%S%S%S%S%SHKCU\HKLM\msn%s_onstate_%soff%s.%s (p='%S')pop3://%s:%s@%s:%dpopgrab%s:%s@%s:%danonymousftp://%s:%s@%s:%dftpgrab%s.%s ->> %s (%s : %s)%s.%s ->> %s : %sDirectadminWHCMSWHMcPanelblog%s-%s-%sffgrabiegrabMicrosoft Unified Security Protocol Provider%s.Blocked possible browser exploit pack call on URL '%s'scrpifcom%s.Blocked possible browser exploit pack call on URL '%S'webroot.fortinet.virusbuster.nprotect.gdatasoftware.virus.precisesecurity.lavasoft.heck.tcemsisoft.onlinemalwarescanner.onecare.live.f-secure.bullguard.clamav.pandasecurity.sophos.malwarebytes.sunbeltsoftware.norton.norman.mcafee.symanteccomodo.avast.avira.avg.bitdefender.eset.kaspersky.trendmicro.iseclab.virscan.garyshood.viruschief.jotti.threatexpert.novirusthanks.virustotal.ipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exelogin[password]login[username]members.iknowthatgirl/membersIKnowThatGirlyouporn./loginYouPornmembers.brazzers.comBrazzersclavenumeroTarjetaclave=*bcointernacionalloginBcointernacional:2222/CMD_LOGIN*whcmsdologin:2086/login:2083/login:2082/loginwebnames.ru/user_loginWebnamesdotster.com/loginDotsterloginidenom.com/loginEnomlogin.Passlogin.Userlogin.Pass=*1and1.com/xml/config1and1tokenmoniker.com/LoginMonikerLoginPasswordLoginUserNameLoginPassword=*namecheap.com/loginNamecheaploginnamegodaddy.com/loginGodaddyPasswordEmailNamePassword=*alertpay.com/loginAlertpaynetflix.com/oginNetflixthepiratebay.org/loginThepiratebaytorrentleech.org/loginTorrentleechvip-file.com//signin-doVip-filepaslogpas=*sms4file.com//signin-doSms4fileletitbit.netLetitbitwhat.cd/loginWhatcdoron.com/loginOronfilesonic.com/loginFilesonicspeedyshare.com/loginSpeedysharepwidpw=uploaded.to/loginUploadeduploading.com/loginUploadingloginUserPasswordloginUserNameloginUserPassword=fileserv.com/loginFileservehotfile.com/loginHotfile4shared.com/login4sharedtxtpasstxtusertxtpass=netload.in/indexNetloadfreakshare.com/loginFreaksharelogin_passlogin_pass=mediafire.com/loginMediafiresendspace.com/loginSendspacemegaupload./login*Mega
Source: QgGhoOpxHPl.exe, 0000002A.00000002.620410514.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: shellexecute=[autorun]
Source: QgGhoOpxHPl.exe, 0000002A.00000002.620410514.0000000000100000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .lnk%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %%cd%%%s/c "start %%cd%%RECYCLED\%sRECYCLED...inf%s%s\\.\%c:%S%S\Desktop.ini%s\%s%S%sautorun.tmp%sautorun.inf:\%c:\gdkWindowToplevelClass%0x.execomment-textbebo./c/home/ajax_post_lifestream_commentbebo Lifestreambebo./c/profile/comment_post.jsonbebo CommentMessagebebo./mail/MailCompose.jspbebo Messagefriendster./sendmessage.phpFriendster MessagecommentFriendster Commentshoutoutfriendster./rpc.phpFriendster Shoutoutvkontakte.ru/mail.phpvkontakte Messagevkontakte.ru/wall.phpvkontakte Wallmessagevkontakte.ru/api.phpvkontakte Chattexttwitter./direct_messages/newTwitter Messagetwitter./status/updateTwitter Tweetstatusfacebook./ajax/MessageComposerEndpoint.phpFacebook Messagemsg_textfacebook./ajax/chat/send.phpFacebook IM-_.!~*'()+Content-Length: %s.%s hijacked!%s=MSG %d %s %d

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_006045E0 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	0_2_006045E0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_006045E0 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	2_2_006045E0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_0036F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	4_2_0036F130
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_0040F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	4_2_0040F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003DF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	9_2_003DF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_0018F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	10_2_0018F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_0038F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	11_2_0038F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_0041F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	12_2_0041F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001BF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	13_2_001BF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_0035F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	14_2_0035F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_0031F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	15_2_0031F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_0038F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	16_2_0038F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	17_2_0010F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	18_2_0010F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_0022F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	19_2_0022F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_0032F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	20_2_0032F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_0051F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	21_2_0051F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_0019F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	22_2_0019F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_0084F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	23_2_0084F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_0040F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	25_2_0040F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_0082F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	26_2_0082F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	27_2_0009F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005DF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	29_2_005DF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	30_2_0009F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_0091F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	31_2_0091F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_0039F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	32_2_0039F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	33_2_0009F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_0022F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	34_2_0022F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_0015F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	35_2_0015F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007FF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	36_2_007FF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_0025F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	37_2_0025F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_0026F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	38_2_0026F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003FF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	39_2_003FF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003FF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	40_2_003FF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_0028F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	41_2_0028F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	42_2_0010F130

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_0036F9E0 memset,GetLogicalDriveStringsA,lstrcatA,lstrcatA,

4_2_0036F9E0

Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137
Source: Joe Sandbox View	IP Address: 18.244.18.38 18.244.18.38

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_0036AA10 memset,lstrcpyA,InternetOpenA,lstrlenA,InternetOpenUrlA,HttpQueryInfoA,InternetQueryDataAvailable,InternetReadFile,??2@YAPAXI@Z,InternetReadFile,??2@YAPAXI@Z,??3@YAXPAX@Z,InternetCloseHandle,

4_2_0036AA10

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\favicon[1].ico

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /jquery-3.6.3.min.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: code.jquery.comDNT: 1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /b?rn=1735632299605&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=0B7EB9A71D6D654F0B8CACC11CC56471&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Accept: image/png, image/svg+xml, image/;q=0.8, /*;q=0.5Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sb.scorecardresearch.comDNT: 1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /b2?rn=1735632299605&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=0B7EB9A71D6D654F0B8CACC11CC56471&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Accept: image/png, image/svg+xml, image/;q=0.8, /*;q=0.5Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sb.scorecardresearch.comDNT: 1Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com

Source: QgGhoOpxHPl.exe, 0000002A.00000002.620410514.0000000000100000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://api.wipmania.com/
Source: imagestore.dat.24.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: YJ1BHFNR.htm.24.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js
Source: YJ1BHFNR.htm.24.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js
Source: YJ1BHFNR.htm.24.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js
Source: YJ1BHFNR.htm.24.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js
Source: {E68EA6F6-C74D-11EF-8F38-ECF4BBB5915B}.dat.6.dr, ~DF854EA4F5FD60E78B.TMP.6.dr	String found in binary or memory: https://www.msn.com/?ocid=iehp
Source: imagestore.dat.24.dr	String found in binary or memory: https://www.msn.com/favicon.ico
Source: experience.b374b0d5b40196862f17[1].js.24.dr	String found in binary or memory: https://www.msn.com/fr-ch/actualite/other/Mentions-l

Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.18.38:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.18.38:443 -> 192.168.2.22:49174 version: TLS 1.2

Operating System Destruction

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00369D90 CreateFileA on filename \\.\PHYSICALDRIVE0	4_2_00369D90
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00409D90 CreateFileA on filename \\.\PHYSICALDRIVE0	4_2_00409D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D9D90 CreateFileA on filename \\.\PHYSICALDRIVE0	9_2_003D9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_00189D90 CreateFileA on filename \\.\PHYSICALDRIVE0	10_2_00189D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_00389D90 CreateFileA on filename \\.\PHYSICALDRIVE0	11_2_00389D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_00419D90 CreateFileA on filename \\.\PHYSICALDRIVE0	12_2_00419D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B9D90 CreateFileA on filename \\.\PHYSICALDRIVE0	13_2_001B9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_00359D90 CreateFileA on filename \\.\PHYSICALDRIVE0	14_2_00359D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_00319D90 CreateFileA on filename \\.\PHYSICALDRIVE0	15_2_00319D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_00389D90 CreateFileA on filename \\.\PHYSICALDRIVE0	16_2_00389D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_00109D90 CreateFileA on filename \\.\PHYSICALDRIVE0	17_2_00109D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_00109D90 CreateFileA on filename \\.\PHYSICALDRIVE0	18_2_00109D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_00229D90 CreateFileA on filename \\.\PHYSICALDRIVE0	19_2_00229D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_00329D90 CreateFileA on filename \\.\PHYSICALDRIVE0	20_2_00329D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_00519D90 CreateFileA on filename \\.\PHYSICALDRIVE0	21_2_00519D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_00199D90 CreateFileA on filename \\.\PHYSICALDRIVE0	22_2_00199D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_00849D90 CreateFileA on filename \\.\PHYSICALDRIVE0	23_2_00849D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_00409D90 CreateFileA on filename \\.\PHYSICALDRIVE0	25_2_00409D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_00829D90 CreateFileA on filename \\.\PHYSICALDRIVE0	26_2_00829D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_00099D90 CreateFileA on filename \\.\PHYSICALDRIVE0	27_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D9D90 CreateFileA on filename \\.\PHYSICALDRIVE0	29_2_005D9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_00099D90 CreateFileA on filename \\.\PHYSICALDRIVE0	30_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_00919D90 CreateFileA on filename \\.\PHYSICALDRIVE0	31_2_00919D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_00399D90 CreateFileA on filename \\.\PHYSICALDRIVE0	32_2_00399D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_00099D90 CreateFileA on filename \\.\PHYSICALDRIVE0	33_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_00229D90 CreateFileA on filename \\.\PHYSICALDRIVE0	34_2_00229D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_00159D90 CreateFileA on filename \\.\PHYSICALDRIVE0	35_2_00159D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F9D90 CreateFileA on filename \\.\PHYSICALDRIVE0	36_2_007F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_00259D90 CreateFileA on filename \\.\PHYSICALDRIVE0	37_2_00259D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_00269D90 CreateFileA on filename \\.\PHYSICALDRIVE0	38_2_00269D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F9D90 CreateFileA on filename \\.\PHYSICALDRIVE0	39_2_003F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F9D90 CreateFileA on filename \\.\PHYSICALDRIVE0	40_2_003F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_00289D90 CreateFileA on filename \\.\PHYSICALDRIVE0	41_2_00289D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_00109D90 CreateFileA on filename \\.\PHYSICALDRIVE0	42_2_00109D90

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Start Page Redirect Cache

Jump to behavior

System Summary

Yara detected Darkbot

Source: Yara match	File source: Process Memory Space: 25F.tmp.exe PID: 3356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 25F.tmp.exe PID: 3380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 3068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 2228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 1852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QgGhoOpxHPl.exe PID: 772, type: MEMORYSTR

Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00609014 LoadLibraryA,LoadLibraryA,CreateProcessA,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,	0_2_00609014
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00401170 ShowCaret,ShowCaret,ShowCaret,NtUnmapViewOfSection,ShowCaret,VirtualAllocEx,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,WriteProcessMemory,ShowCaret,ShowCaret,Wow64SetThreadContext,ShowCaret,ResumeThread,	2_2_00401170
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00365C50 NtQueryInformationProcess,	4_2_00365C50
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00364D00 GetVersionExA,strncpy,NtQueryInformationProcess,	4_2_00364D00
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00365820 memset,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,InterlockedCompareExchange,WideCharToMultiByte,Sleep,CloseHandle,	4_2_00365820
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00363440 printf,printf,printf,NtAllocateVirtualMemory,	4_2_00363440
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_003656E0 NtQuerySystemInformation,NtQuerySystemInformation,	4_2_003656E0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_003653D0 NtQueryInformationThread,OpenProcess,NtQueryInformationProcess,InterlockedCompareExchange,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,CloseHandle,	4_2_003653D0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_004056E0 NtQuerySystemInformation,NtQuerySystemInformation,	4_2_004056E0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00404D00 GetVersionExA,strncpy,NtQueryInformationProcess,	4_2_00404D00
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00403440 printf,printf,printf,NtAllocateVirtualMemory,	4_2_00403440
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00405C50 NtQueryInformationProcess,	4_2_00405C50
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00405820 memset,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,InterlockedCompareExchange,WideCharToMultiByte,Sleep,CloseHandle,	4_2_00405820
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_004053D0 NtQueryInformationThread,OpenProcess,NtQueryInformationProcess,InterlockedCompareExchange,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,CloseHandle,	4_2_004053D0

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_00369E7B: WriteFile,DeviceIoControl,

4_2_00369E7B

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00362D60	4_2_00362D60
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00402D60	4_2_00402D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D2D60	9_2_003D2D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_00182D60	10_2_00182D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_00382D60	11_2_00382D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_00412D60	12_2_00412D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B2D60	13_2_001B2D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_00352D60	14_2_00352D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_00312D60	15_2_00312D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_00382D60	16_2_00382D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_00102D60	17_2_00102D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_00102D60	18_2_00102D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_00222D60	19_2_00222D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_00322D60	20_2_00322D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_00512D60	21_2_00512D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_00192D60	22_2_00192D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_00842D60	23_2_00842D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_00402D60	25_2_00402D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_00822D60	26_2_00822D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_00092D60	27_2_00092D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D2D60	29_2_005D2D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_00092D60	30_2_00092D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_00912D60	31_2_00912D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_00392D60	32_2_00392D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_00092D60	33_2_00092D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_00222D60	34_2_00222D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_00152D60	35_2_00152D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F2D60	36_2_007F2D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_00252D60	37_2_00252D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_00262D60	38_2_00262D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F2D60	39_2_003F2D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F2D60	40_2_003F2D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_00282D60	41_2_00282D60
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_00102D60	42_2_00102D60

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: String function: 0040BA00 appears 37 times
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: String function: 00608CB8 appears 34 times
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: String function: 00603DEC appears 34 times
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: String function: 0036BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0032BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0040BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0022A310 appears 46 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0009BA00 appears 111 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0041BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0015BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 007FBA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0031BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 003FB990 appears 48 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0038B990 appears 48 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0025BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0026BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0010B990 appears 72 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0035BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0091BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 001BBA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0022BA00 appears 74 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0009A310 appears 69 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0051BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0038BA00 appears 74 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0038A310 appears 46 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 005DBA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0039BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0022B990 appears 48 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 003FA310 appears 46 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0010BA00 appears 111 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 003FBA00 appears 74 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0010A310 appears 69 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0082BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0028BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 003DBA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0084BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0019BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0018BA00 appears 37 times
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: String function: 0009B990 appears 72 times

Source: 25F.tmp.exe

Binary or memory string: OriginalFilenameChangeici4 vs 25F.tmp.exe

Source: 25F.tmp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/38@6/2

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00364C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	4_2_00364C20
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_0036A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	4_2_0036A550
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00404C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	4_2_00404C20
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_0040A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	4_2_0040A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	9_2_003D4C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003DA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	9_2_003DA550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_00184C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	10_2_00184C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_0018A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	10_2_0018A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_00384C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	11_2_00384C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_0038A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	11_2_0038A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_00414C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	12_2_00414C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_0041A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	12_2_0041A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	13_2_001B4C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001BA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	13_2_001BA550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_00354C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	14_2_00354C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_0035A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	14_2_0035A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_00314C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	15_2_00314C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_0031A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	15_2_0031A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_00384C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	16_2_00384C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_0038A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	16_2_0038A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_00104C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	17_2_00104C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_0010A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	17_2_0010A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_00104C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	18_2_00104C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_0010A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	18_2_0010A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_00224C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	19_2_00224C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_0022A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	19_2_0022A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_00324C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	20_2_00324C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_0032A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	20_2_0032A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_00514C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	21_2_00514C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_0051A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	21_2_0051A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_00194C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	22_2_00194C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_0019A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	22_2_0019A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_00844C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	23_2_00844C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_0084A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	23_2_0084A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_00404C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	25_2_00404C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_0040A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	25_2_0040A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_00824C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	26_2_00824C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_0082A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	26_2_0082A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_00094C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	27_2_00094C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_0009A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	27_2_0009A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	29_2_005D4C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005DA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	29_2_005DA550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_00094C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	30_2_00094C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_0009A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	30_2_0009A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_00914C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	31_2_00914C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_0091A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	31_2_0091A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_00394C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	32_2_00394C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_0039A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	32_2_0039A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_00094C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	33_2_00094C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_0009A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	33_2_0009A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_00224C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	34_2_00224C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_0022A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	34_2_0022A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_00154C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	35_2_00154C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_0015A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	35_2_0015A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	36_2_007F4C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007FA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	36_2_007FA550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_00254C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	37_2_00254C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_0025A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	37_2_0025A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_00264C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	38_2_00264C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_0026A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	38_2_0026A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	39_2_003F4C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003FA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	39_2_003FA550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F4C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	40_2_003F4C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003FA550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	40_2_003FA550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_00284C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	41_2_00284C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_0028A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	41_2_0028A550
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_00104C20 OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,	42_2_00104C20
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_0010A550 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	42_2_0010A550

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 0_2_00605F28 GetDiskFreeSpaceA,

0_2_00605F28

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_0036EE40 CoCreateInstance,memset,lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFileInfoA,memset,lstrcpyA,lstrcatA,MultiByteToWideChar,

4_2_0036EE40

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Low

Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe

Mutant created: \Sessions\1\BaseNamedObjects\-d1ff3a37Mutex

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF3A6EF28F490D6D3E.TMP

Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe

File read: C:\Users\user\Desktop\25F.tmp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\25F.tmp.exe "C:\Users\user\Desktop\25F.tmp.exe"
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Users\user\Desktop\25F.tmp.exe C:\Users\user\Desktop\25F.tmp.exe
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Windows\notepad.exe "C:\Windows\notepad.exe"
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Users\user\Desktop\25F.tmp.exe C:\Users\user\Desktop\25F.tmp.exe
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:275457 /prefetch:2
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Users\user\Desktop\25F.tmp.exe C:\Users\user\Desktop\25F.tmp.exe	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Windows\notepad.exe "C:\Windows\notepad.exe"	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Users\user\Desktop\25F.tmp.exe C:\Users\user\Desktop\25F.tmp.exe	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\IEXPLORE.EXE"	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:275457 /prefetch:2	Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\notepad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\notepad.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\25F.tmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Jump to behavior

Source:

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\25F.tmp.exe	Unpacked PE file: 2.2.25F.tmp.exe.400000.0.unpack
Source: C:\Users\user\Desktop\25F.tmp.exe	Unpacked PE file: 4.2.25F.tmp.exe.360000.0.unpack
Source: C:\Users\user\Desktop\25F.tmp.exe	Unpacked PE file: 4.2.25F.tmp.exe.400000.1.unpack

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 2_2_0040399B LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_0040399B

Source: 25F.tmp.exe

Static PE information: real checksum: 0x37c3c should be: 0x2f560

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_0060502C push 006052E0h; ret	0_2_006052D8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00604C3C push 00604C8Dh; ret	0_2_00604C85
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_0060983C push 00609874h; ret	0_2_0060986C
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00609880 push 006098A6h; ret	0_2_0060989E
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00602C98 push eax; ret	0_2_00602CD4
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_006085C4 push 00608740h; ret	0_2_00608738
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_006085BA push 00608740h; ret	0_2_00608738
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00604E6C push 00604E98h; ret	0_2_00604E90
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00604EA4 push 00604ED0h; ret	0_2_00604EC8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_006052B4 push 006052E0h; ret	0_2_006052D8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00608742 push 006087B3h; ret	0_2_006087AB
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00608744 push 006087B3h; ret	0_2_006087AB
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00604FF4 push 00605020h; ret	0_2_00605018
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00605FC8 push ecx; mov dword ptr [esp], eax	0_2_00605FC9
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_0060502C push 006052E0h; ret	2_2_006052D8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00604C3C push 00604C8Dh; ret	2_2_00604C85
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_0060983C push 00609874h; ret	2_2_0060986C
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00609880 push 006098A6h; ret	2_2_0060989E
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00602C98 push eax; ret	2_2_00602CD4
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_006085C4 push 00608740h; ret	2_2_00608738
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_006085BA push 00608740h; ret	2_2_00608738
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00604E6C push 00604E98h; ret	2_2_00604E90
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00604EA4 push 00604ED0h; ret	2_2_00604EC8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_006052B4 push 006052E0h; ret	2_2_006052D8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00608742 push 006087B3h; ret	2_2_006087AB
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00608744 push 006087B3h; ret	2_2_006087AB
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00604FF4 push 00605020h; ret	2_2_00605018
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00605FC8 push ecx; mov dword ptr [esp], eax	2_2_00605FC9
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00404290 push eax; ret	2_2_004042BE
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00370F10 push eax; ret	4_2_00370F3E
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_00410F10 push eax; ret	4_2_00410F3E

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	4_2_00369EC0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00369D90
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	4_2_00409EC0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00409D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	9_2_003D9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	9_2_003D9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	10_2_00189EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_00189D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	11_2_00389EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_00389D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	12_2_00419EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_00419D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	13_2_001B9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_001B9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	14_2_00359EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	14_2_00359D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	15_2_00319EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	15_2_00319D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	16_2_00389EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	16_2_00389D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	17_2_00109EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	17_2_00109D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	18_2_00109EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	18_2_00109D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	19_2_00229EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	19_2_00229D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	20_2_00329EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	20_2_00329D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	21_2_00519EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	21_2_00519D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	22_2_00199EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	22_2_00199D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	23_2_00849EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	23_2_00849D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	25_2_00409EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	25_2_00409D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	26_2_00829EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	26_2_00829D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	27_2_00099EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	27_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	29_2_005D9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	29_2_005D9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	30_2_00099EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	30_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	31_2_00919EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	31_2_00919D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	32_2_00399EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	32_2_00399D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	33_2_00099EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	33_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	34_2_00229EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	34_2_00229D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	35_2_00159EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	35_2_00159D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	36_2_007F9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	36_2_007F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	37_2_00259EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	37_2_00259D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	38_2_00269EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	38_2_00269D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	39_2_003F9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	39_2_003F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	40_2_003F9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	40_2_003F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	41_2_00289EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	41_2_00289D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	42_2_00109EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	42_2_00109D90

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	4_2_00369EC0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00369D90
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	4_2_00409EC0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00409D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	9_2_003D9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	9_2_003D9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	10_2_00189EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_00189D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	11_2_00389EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_00389D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	12_2_00419EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_00419D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	13_2_001B9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_001B9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	14_2_00359EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	14_2_00359D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	15_2_00319EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	15_2_00319D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	16_2_00389EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	16_2_00389D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	17_2_00109EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	17_2_00109D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	18_2_00109EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	18_2_00109D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	19_2_00229EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	19_2_00229D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	20_2_00329EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	20_2_00329D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	21_2_00519EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	21_2_00519D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	22_2_00199EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	22_2_00199D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	23_2_00849EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	23_2_00849D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	25_2_00409EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	25_2_00409D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	26_2_00829EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	26_2_00829D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	27_2_00099EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	27_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	29_2_005D9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	29_2_005D9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	30_2_00099EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	30_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	31_2_00919EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	31_2_00919D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	32_2_00399EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	32_2_00399D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	33_2_00099EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	33_2_00099D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	34_2_00229EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	34_2_00229D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	35_2_00159EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	35_2_00159D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	36_2_007F9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	36_2_007F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	37_2_00259EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	37_2_00259D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	38_2_00269EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	38_2_00269D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	39_2_003F9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	39_2_003F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	40_2_003F9EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	40_2_003F9D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	41_2_00289EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	41_2_00289D90
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,CreateFileA,DeviceIoControl,DeviceIoControl,WriteFile,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE0	42_2_00109EC0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: VirtualAlloc,CreateFileA,DeviceIoControl,SetFilePointer,WriteFile,WriteFile,SetFilePointer,WriteFile,WriteFile,DeviceIoControl, \\.\PHYSICALDRIVE0	42_2_00109D90

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 774CFA50 value: E9 3B 69 F0 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 774CFDA8 value: E9 93 68 F0 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 757158CD value: E9 2E B7 CB 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 757182ED value: E9 AE 8D CB 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 7576DF21 value: E9 EA 45 C6 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 75709AE0 value: E9 8B 8A CC 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 756F5366 value: E9 55 BE CD 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 756F3EFC value: E9 8F D3 CD 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 69CBA9B0 value: E9 3B 6D 71 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 69CA572C value: E9 AF C0 72 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 769A6C19 value: E9 32 06 A3 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 769A4889 value: E9 82 D4 A2 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 76A91D20 value: E9 7B 03 94 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 76A0BF10 value: E9 4B 62 9C 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 76A81610 value: E9 8B 0D 95 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 774D0078 value: E9 53 53 F0 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2384 base: 774EEB2A value: E9 D1 67 EE 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 774CFA50 value: E9 3B 69 CB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 774CFDA8 value: E9 93 68 CB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 757158CD value: E9 2E B7 A6 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 757182ED value: E9 AE 8D A6 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 7576DF21 value: E9 EA 45 A1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 75709AE0 value: E9 8B 8A A7 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 756F5366 value: E9 55 BE A8 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 756F3EFC value: E9 8F D3 A8 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 69CBA9B0 value: E9 3B 6D 4C 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 69CA572C value: E9 AF C0 4D 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 769A6C19 value: E9 32 06 7E 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 769A4889 value: E9 82 D4 7D 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 76A91D20 value: E9 7B 03 6F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 76A0BF10 value: E9 4B 62 77 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 76A81610 value: E9 8B 0D 70 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 774D0078 value: E9 53 53 CB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1440 base: 774EEB2A value: E9 D1 67 C9 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 774CFA50 value: E9 3B 69 EB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 774CFDA8 value: E9 93 68 EB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 757158CD value: E9 2E B7 C6 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 757182ED value: E9 AE 8D C6 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 7576DF21 value: E9 EA 45 C1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 75709AE0 value: E9 8B 8A C7 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 756F5366 value: E9 55 BE C8 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 756F3EFC value: E9 8F D3 C8 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 69CBA9B0 value: E9 3B 6D 6C 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 69CA572C value: E9 AF C0 6D 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 769A6C19 value: E9 32 06 9E 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 769A4889 value: E9 82 D4 9D 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 76A91D20 value: E9 7B 03 8F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 76A0BF10 value: E9 4B 62 97 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 76A81610 value: E9 8B 0D 90 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 774D0078 value: E9 53 53 EB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2096 base: 774EEB2A value: E9 D1 67 E9 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 774CFA50 value: E9 3B 69 F4 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 774CFDA8 value: E9 93 68 F4 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 757158CD value: E9 2E B7 CF 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 757182ED value: E9 AE 8D CF 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 7576DF21 value: E9 EA 45 CA 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 75709AE0 value: E9 8B 8A D0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 756F5366 value: E9 55 BE D1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 756F3EFC value: E9 8F D3 D1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 69CBA9B0 value: E9 3B 6D 75 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 69CA572C value: E9 AF C0 76 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 769A6C19 value: E9 32 06 A7 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 769A4889 value: E9 82 D4 A6 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 76A91D20 value: E9 7B 03 98 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 76A0BF10 value: E9 4B 62 A0 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 76A81610 value: E9 8B 0D 99 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 774D0078 value: E9 53 53 F4 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1804 base: 774EEB2A value: E9 D1 67 F2 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 774CFA50 value: E9 3B 69 CE 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 774CFDA8 value: E9 93 68 CE 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 757158CD value: E9 2E B7 A9 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 757182ED value: E9 AE 8D A9 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 7576DF21 value: E9 EA 45 A4 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 75709AE0 value: E9 8B 8A AA 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 756F5366 value: E9 55 BE AB 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 756F3EFC value: E9 8F D3 AB 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 69CBA9B0 value: E9 3B 6D 4F 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 69CA572C value: E9 AF C0 50 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 769A6C19 value: E9 32 06 81 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 769A4889 value: E9 82 D4 80 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 76A91D20 value: E9 7B 03 72 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 76A0BF10 value: E9 4B 62 7A 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 76A81610 value: E9 8B 0D 73 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 774D0078 value: E9 53 53 CE 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 892 base: 774EEB2A value: E9 D1 67 CC 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 774CFA50 value: E9 3B 69 E8 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 774CFDA8 value: E9 93 68 E8 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 757158CD value: E9 2E B7 C3 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 757182ED value: E9 AE 8D C3 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 7576DF21 value: E9 EA 45 BE 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 75709AE0 value: E9 8B 8A C4 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 756F5366 value: E9 55 BE C5 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 756F3EFC value: E9 8F D3 C5 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 69CBA9B0 value: E9 3B 6D 69 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 69CA572C value: E9 AF C0 6A 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 769A6C19 value: E9 32 06 9B 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 769A4889 value: E9 82 D4 9A 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 76A91D20 value: E9 7B 03 8C 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 76A0BF10 value: E9 4B 62 94 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 76A81610 value: E9 8B 0D 8D 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 774D0078 value: E9 53 53 E8 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1968 base: 774EEB2A value: E9 D1 67 E6 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 774CFA50 value: E9 3B 69 E4 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 774CFDA8 value: E9 93 68 E4 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 757158CD value: E9 2E B7 BF 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 757182ED value: E9 AE 8D BF 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 7576DF21 value: E9 EA 45 BA 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 75709AE0 value: E9 8B 8A C0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 756F5366 value: E9 55 BE C1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 756F3EFC value: E9 8F D3 C1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 69CBA9B0 value: E9 3B 6D 65 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 69CA572C value: E9 AF C0 66 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 769A6C19 value: E9 32 06 97 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 769A4889 value: E9 82 D4 96 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 76A91D20 value: E9 7B 03 88 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 76A0BF10 value: E9 4B 62 90 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 76A81610 value: E9 8B 0D 89 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 774D0078 value: E9 53 53 E4 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 172 base: 774EEB2A value: E9 D1 67 E2 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 774CFA50 value: E9 3B 69 EB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 774CFDA8 value: E9 93 68 EB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 757158CD value: E9 2E B7 C6 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 757182ED value: E9 AE 8D C6 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 7576DF21 value: E9 EA 45 C1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 75709AE0 value: E9 8B 8A C7 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 756F5366 value: E9 55 BE C8 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 756F3EFC value: E9 8F D3 C8 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 69CBA9B0 value: E9 3B 6D 6C 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 69CA572C value: E9 AF C0 6D 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 769A6C19 value: E9 32 06 9E 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 769A4889 value: E9 82 D4 9D 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 76A91D20 value: E9 7B 03 8F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 76A0BF10 value: E9 4B 62 97 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 76A81610 value: E9 8B 0D 90 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 774D0078 value: E9 53 53 EB 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 492 base: 774EEB2A value: E9 D1 67 E9 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 774CFA50 value: E9 3B 69 C3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 774CFDA8 value: E9 93 68 C3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 757158CD value: E9 2E B7 9E 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 757182ED value: E9 AE 8D 9E 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 7576DF21 value: E9 EA 45 99 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 75709AE0 value: E9 8B 8A 9F 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 756F5366 value: E9 55 BE A0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 756F3EFC value: E9 8F D3 A0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 69CBA9B0 value: E9 3B 6D 44 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 69CA572C value: E9 AF C0 45 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 769A6C19 value: E9 32 06 76 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 769A4889 value: E9 82 D4 75 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 76A91D20 value: E9 7B 03 67 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 76A0BF10 value: E9 4B 62 6F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 76A81610 value: E9 8B 0D 68 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 774D0078 value: E9 53 53 C3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1784 base: 774EEB2A value: E9 D1 67 C1 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 774CFA50 value: E9 3B 69 C3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 774CFDA8 value: E9 93 68 C3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 757158CD value: E9 2E B7 9E 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 757182ED value: E9 AE 8D 9E 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 7576DF21 value: E9 EA 45 99 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 75709AE0 value: E9 8B 8A 9F 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 756F5366 value: E9 55 BE A0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 756F3EFC value: E9 8F D3 A0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 69CBA9B0 value: E9 3B 6D 44 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 69CA572C value: E9 AF C0 45 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 769A6C19 value: E9 32 06 76 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 769A4889 value: E9 82 D4 75 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 76A91D20 value: E9 7B 03 67 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 76A0BF10 value: E9 4B 62 6F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 76A81610 value: E9 8B 0D 68 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 774D0078 value: E9 53 53 C3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1396 base: 774EEB2A value: E9 D1 67 C1 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 774CFA50 value: E9 3B 69 D5 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 774CFDA8 value: E9 93 68 D5 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 757158CD value: E9 2E B7 B0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 757182ED value: E9 AE 8D B0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 7576DF21 value: E9 EA 45 AB 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 75709AE0 value: E9 8B 8A B1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 756F5366 value: E9 55 BE B2 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 756F3EFC value: E9 8F D3 B2 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 69CBA9B0 value: E9 3B 6D 56 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 69CA572C value: E9 AF C0 57 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 769A6C19 value: E9 32 06 88 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 769A4889 value: E9 82 D4 87 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 76A91D20 value: E9 7B 03 79 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 76A0BF10 value: E9 4B 62 81 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 76A81610 value: E9 8B 0D 7A 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 774D0078 value: E9 53 53 D5 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 816 base: 774EEB2A value: E9 D1 67 D3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 774CFA50 value: E9 3B 69 E5 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 774CFDA8 value: E9 93 68 E5 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 757158CD value: E9 2E B7 C0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 757182ED value: E9 AE 8D C0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 7576DF21 value: E9 EA 45 BB 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 75709AE0 value: E9 8B 8A C1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 756F5366 value: E9 55 BE C2 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 756F3EFC value: E9 8F D3 C2 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 69CBA9B0 value: E9 3B 6D 66 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 69CA572C value: E9 AF C0 67 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 769A6C19 value: E9 32 06 98 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 769A4889 value: E9 82 D4 97 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 76A91D20 value: E9 7B 03 89 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 76A0BF10 value: E9 4B 62 91 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 76A81610 value: E9 8B 0D 8A 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 774D0078 value: E9 53 53 E5 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1012 base: 774EEB2A value: E9 D1 67 E3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 774CFA50 value: E9 3B 69 04 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 774CFDA8 value: E9 93 68 04 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 757158CD value: E9 2E B7 DF 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 757182ED value: E9 AE 8D DF 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 7576DF21 value: E9 EA 45 DA 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 75709AE0 value: E9 8B 8A E0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 756F5366 value: E9 55 BE E1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 756F3EFC value: E9 8F D3 E1 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 69CBA9B0 value: E9 3B 6D 85 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 69CA572C value: E9 AF C0 86 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 769A6C19 value: E9 32 06 B7 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 769A4889 value: E9 82 D4 B6 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 76A91D20 value: E9 7B 03 A8 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 76A0BF10 value: E9 4B 62 B0 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 76A81610 value: E9 8B 0D A9 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 774D0078 value: E9 53 53 04 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1668 base: 774EEB2A value: E9 D1 67 02 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 774CFA50 value: E9 3B 69 CC 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 774CFDA8 value: E9 93 68 CC 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 757158CD value: E9 2E B7 A7 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 757182ED value: E9 AE 8D A7 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 7576DF21 value: E9 EA 45 A2 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 75709AE0 value: E9 8B 8A A8 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 756F5366 value: E9 55 BE A9 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 756F3EFC value: E9 8F D3 A9 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 69CBA9B0 value: E9 3B 6D 4D 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 69CA572C value: E9 AF C0 4E 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 769A6C19 value: E9 32 06 7F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 769A4889 value: E9 82 D4 7E 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 76A91D20 value: E9 7B 03 70 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 76A0BF10 value: E9 4B 62 78 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 76A81610 value: E9 8B 0D 71 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 774D0078 value: E9 53 53 CC 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2836 base: 774EEB2A value: E9 D1 67 CA 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 774CFA50 value: E9 3B 69 37 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 774CFDA8 value: E9 93 68 37 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 757158CD value: E9 2E B7 12 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 757182ED value: E9 AE 8D 12 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 7576DF21 value: E9 EA 45 0D 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 75709AE0 value: E9 8B 8A 13 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 756F5366 value: E9 55 BE 14 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 756F3EFC value: E9 8F D3 14 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 69CBA9B0 value: E9 3B 6D B8 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 69CA572C value: E9 AF C0 B9 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 769A6C19 value: E9 32 06 EA 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 769A4889 value: E9 82 D4 E9 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 76A91D20 value: E9 7B 03 DB 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 76A0BF10 value: E9 4B 62 E3 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 76A81610 value: E9 8B 0D DC 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 774D0078 value: E9 53 53 37 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1756 base: 774EEB2A value: E9 D1 67 35 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 774CFA50 value: E9 3B 69 F3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 774CFDA8 value: E9 93 68 F3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 757158CD value: E9 2E B7 CE 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 757182ED value: E9 AE 8D CE 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 7576DF21 value: E9 EA 45 C9 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 75709AE0 value: E9 8B 8A CF 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 756F5366 value: E9 55 BE D0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 756F3EFC value: E9 8F D3 D0 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 69CBA9B0 value: E9 3B 6D 74 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 69CA572C value: E9 AF C0 75 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 769A6C19 value: E9 32 06 A6 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 769A4889 value: E9 82 D4 A5 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 76A91D20 value: E9 7B 03 97 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 76A0BF10 value: E9 4B 62 9F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 76A81610 value: E9 8B 0D 98 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 774D0078 value: E9 53 53 F3 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2672 base: 774EEB2A value: E9 D1 67 F1 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 774CFA50 value: E9 3B 69 35 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 774CFDA8 value: E9 93 68 35 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 757158CD value: E9 2E B7 10 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 757182ED value: E9 AE 8D 10 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 7576DF21 value: E9 EA 45 0B 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 75709AE0 value: E9 8B 8A 11 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 756F5366 value: E9 55 BE 12 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 756F3EFC value: E9 8F D3 12 8B	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 69CBA9B0 value: E9 3B 6D B6 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 69CA572C value: E9 AF C0 B7 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 769A6C19 value: E9 32 06 E8 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 769A4889 value: E9 82 D4 E7 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 76A91D20 value: E9 7B 03 D9 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 76A0BF10 value: E9 4B 62 E1 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 76A81610 value: E9 8B 0D DA 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 774D0078 value: E9 53 53 35 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2708 base: 774EEB2A value: E9 D1 67 33 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 774CFA50 value: E9 3B 69 BC 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 774CFDA8 value: E9 93 68 BC 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 757158CD value: E9 2E B7 97 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 757182ED value: E9 AE 8D 97 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 7576DF21 value: E9 EA 45 92 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 75709AE0 value: E9 8B 8A 98 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 756F5366 value: E9 55 BE 99 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 756F3EFC value: E9 8F D3 99 8A	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 69CBA9B0 value: E9 3B 6D 3D 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 69CA572C value: E9 AF C0 3E 96	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 769A6C19 value: E9 32 06 6F 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 769A4889 value: E9 82 D4 6E 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 76A91D20 value: E9 7B 03 60 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 76A0BF10 value: E9 4B 62 68 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 76A81610 value: E9 8B 0D 61 89	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 774D0078 value: E9 53 53 BC 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2704 base: 774EEB2A value: E9 D1 67 BA 88	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 774CFA50 value: E9 3B 69 10 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 774CFDA8 value: E9 93 68 10 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 757158CD value: E9 2E B7 EB 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 757182ED value: E9 AE 8D EB 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 7576DF21 value: E9 EA 45 E6 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 75709AE0 value: E9 8B 8A EC 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 756F5366 value: E9 55 BE ED 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 756F3EFC value: E9 8F D3 ED 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 69CBA9B0 value: E9 3B 6D 91 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 69CA572C value: E9 AF C0 92 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 769A6C19 value: E9 32 06 C3 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 769A4889 value: E9 82 D4 C2 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 76A91D20 value: E9 7B 03 B4 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 76A0BF10 value: E9 4B 62 BC 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 76A81610 value: E9 8B 0D B5 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 774D0078 value: E9 53 53 10 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2868 base: 774EEB2A value: E9 D1 67 0E 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 774CFA50 value: E9 3B 69 BC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 774CFDA8 value: E9 93 68 BC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 757158CD value: E9 2E B7 97 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 757182ED value: E9 AE 8D 97 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 7576DF21 value: E9 EA 45 92 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 75709AE0 value: E9 8B 8A 98 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 756F5366 value: E9 55 BE 99 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 756F3EFC value: E9 8F D3 99 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 69CBA9B0 value: E9 3B 6D 3D 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 69CA572C value: E9 AF C0 3E 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 769A6C19 value: E9 32 06 6F 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 769A4889 value: E9 82 D4 6E 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 76A91D20 value: E9 7B 03 60 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 76A0BF10 value: E9 4B 62 68 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 76A81610 value: E9 8B 0D 61 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 774D0078 value: E9 53 53 BC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 3068 base: 774EEB2A value: E9 D1 67 BA 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 774CFA50 value: E9 3B 69 44 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 774CFDA8 value: E9 93 68 44 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 757158CD value: E9 2E B7 1F 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 757182ED value: E9 AE 8D 1F 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 7576DF21 value: E9 EA 45 1A 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 75709AE0 value: E9 8B 8A 20 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 756F5366 value: E9 55 BE 21 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 756F3EFC value: E9 8F D3 21 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 69CBA9B0 value: E9 3B 6D C5 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 69CA572C value: E9 AF C0 C6 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 769A6C19 value: E9 32 06 F7 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 769A4889 value: E9 82 D4 F6 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 76A91D20 value: E9 7B 03 E8 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 76A0BF10 value: E9 4B 62 F0 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 76A81610 value: E9 8B 0D E9 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 774D0078 value: E9 53 53 44 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2684 base: 774EEB2A value: E9 D1 67 42 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 774CFA50 value: E9 3B 69 EC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 774CFDA8 value: E9 93 68 EC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 757158CD value: E9 2E B7 C7 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 757182ED value: E9 AE 8D C7 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 7576DF21 value: E9 EA 45 C2 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 75709AE0 value: E9 8B 8A C8 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 756F5366 value: E9 55 BE C9 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 756F3EFC value: E9 8F D3 C9 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 69CBA9B0 value: E9 3B 6D 6D 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 69CA572C value: E9 AF C0 6E 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 769A6C19 value: E9 32 06 9F 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 769A4889 value: E9 82 D4 9E 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 76A91D20 value: E9 7B 03 90 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 76A0BF10 value: E9 4B 62 98 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 76A81610 value: E9 8B 0D 91 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 774D0078 value: E9 53 53 EC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2688 base: 774EEB2A value: E9 D1 67 EA 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 774CFA50 value: E9 3B 69 BC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 774CFDA8 value: E9 93 68 BC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 757158CD value: E9 2E B7 97 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 757182ED value: E9 AE 8D 97 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 7576DF21 value: E9 EA 45 92 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 75709AE0 value: E9 8B 8A 98 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 756F5366 value: E9 55 BE 99 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 756F3EFC value: E9 8F D3 99 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 69CBA9B0 value: E9 3B 6D 3D 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 69CA572C value: E9 AF C0 3E 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 769A6C19 value: E9 32 06 6F 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 769A4889 value: E9 82 D4 6E 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 76A91D20 value: E9 7B 03 60 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 76A0BF10 value: E9 4B 62 68 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 76A81610 value: E9 8B 0D 61 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 774D0078 value: E9 53 53 BC 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1436 base: 774EEB2A value: E9 D1 67 BA 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 774CFA50 value: E9 3B 69 D5 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 774CFDA8 value: E9 93 68 D5 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 757158CD value: E9 2E B7 B0 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 757182ED value: E9 AE 8D B0 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 7576DF21 value: E9 EA 45 AB 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 75709AE0 value: E9 8B 8A B1 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 756F5366 value: E9 55 BE B2 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 756F3EFC value: E9 8F D3 B2 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 69CBA9B0 value: E9 3B 6D 56 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 69CA572C value: E9 AF C0 57 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 769A6C19 value: E9 32 06 88 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 769A4889 value: E9 82 D4 87 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 76A91D20 value: E9 7B 03 79 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 76A0BF10 value: E9 4B 62 81 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 76A81610 value: E9 8B 0D 7A 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 774D0078 value: E9 53 53 D5 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1452 base: 774EEB2A value: E9 D1 67 D3 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 774CFA50 value: E9 3B 69 C8 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 774CFDA8 value: E9 93 68 C8 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 757158CD value: E9 2E B7 A3 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 757182ED value: E9 AE 8D A3 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 7576DF21 value: E9 EA 45 9E 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 75709AE0 value: E9 8B 8A A4 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 756F5366 value: E9 55 BE A5 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 756F3EFC value: E9 8F D3 A5 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 69CBA9B0 value: E9 3B 6D 49 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 69CA572C value: E9 AF C0 4A 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 769A6C19 value: E9 32 06 7B 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 769A4889 value: E9 82 D4 7A 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 76A91D20 value: E9 7B 03 6C 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 76A0BF10 value: E9 4B 62 74 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 76A81610 value: E9 8B 0D 6D 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 774D0078 value: E9 53 53 C8 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1060 base: 774EEB2A value: E9 D1 67 C6 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 774CFA50 value: E9 3B 69 32 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 774CFDA8 value: E9 93 68 32 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 757158CD value: E9 2E B7 0D 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 757182ED value: E9 AE 8D 0D 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 7576DF21 value: E9 EA 45 08 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 75709AE0 value: E9 8B 8A 0E 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 756F5366 value: E9 55 BE 0F 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 756F3EFC value: E9 8F D3 0F 8B
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 69CBA9B0 value: E9 3B 6D B3 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 69CA572C value: E9 AF C0 B4 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 769A6C19 value: E9 32 06 E5 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 769A4889 value: E9 82 D4 E4 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 76A91D20 value: E9 7B 03 D6 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 76A0BF10 value: E9 4B 62 DE 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 76A81610 value: E9 8B 0D D7 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 774D0078 value: E9 53 53 32 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2248 base: 774EEB2A value: E9 D1 67 30 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 774CFA50 value: E9 3B 69 D8 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 774CFDA8 value: E9 93 68 D8 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 757158CD value: E9 2E B7 B3 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 757182ED value: E9 AE 8D B3 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 7576DF21 value: E9 EA 45 AE 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 75709AE0 value: E9 8B 8A B4 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 756F5366 value: E9 55 BE B5 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 756F3EFC value: E9 8F D3 B5 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 69CBA9B0 value: E9 3B 6D 59 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 69CA572C value: E9 AF C0 5A 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 769A6C19 value: E9 32 06 8B 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 769A4889 value: E9 82 D4 8A 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 76A91D20 value: E9 7B 03 7C 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 76A0BF10 value: E9 4B 62 84 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 76A81610 value: E9 8B 0D 7D 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 774D0078 value: E9 53 53 D8 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1448 base: 774EEB2A value: E9 D1 67 D6 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 774CFA50 value: E9 3B 69 D9 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 774CFDA8 value: E9 93 68 D9 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 757158CD value: E9 2E B7 B4 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 757182ED value: E9 AE 8D B4 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 7576DF21 value: E9 EA 45 AF 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 75709AE0 value: E9 8B 8A B5 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 756F5366 value: E9 55 BE B6 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 756F3EFC value: E9 8F D3 B6 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 69CBA9B0 value: E9 3B 6D 5A 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 69CA572C value: E9 AF C0 5B 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 769A6C19 value: E9 32 06 8C 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 769A4889 value: E9 82 D4 8B 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 76A91D20 value: E9 7B 03 7D 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 76A0BF10 value: E9 4B 62 85 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 76A81610 value: E9 8B 0D 7E 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 774D0078 value: E9 53 53 D9 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 2228 base: 774EEB2A value: E9 D1 67 D7 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 774CFA50 value: E9 3B 69 F2 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 774CFDA8 value: E9 93 68 F2 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 757158CD value: E9 2E B7 CD 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 757182ED value: E9 AE 8D CD 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 7576DF21 value: E9 EA 45 C8 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 75709AE0 value: E9 8B 8A CE 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 756F5366 value: E9 55 BE CF 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 756F3EFC value: E9 8F D3 CF 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 69CBA9B0 value: E9 3B 6D 73 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 69CA572C value: E9 AF C0 74 96
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 769A6C19 value: E9 32 06 A5 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 769A4889 value: E9 82 D4 A4 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 76A91D20 value: E9 7B 03 96 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 76A0BF10 value: E9 4B 62 9E 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 76A81610 value: E9 8B 0D 97 89
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 774D0078 value: E9 53 53 F2 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1260 base: 774EEB2A value: E9 D1 67 F0 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1852 base: 774CFA50 value: E9 3B 69 F2 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1852 base: 774CFDA8 value: E9 93 68 F2 88
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1852 base: 757158CD value: E9 2E B7 CD 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1852 base: 757182ED value: E9 AE 8D CD 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1852 base: 7576DF21 value: E9 EA 45 C8 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1852 base: 75709AE0 value: E9 8B 8A CE 8A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Memory written: PID: 1852 base: 756F5366 value: E9 55 BE CF 8A

Source: C:\Users\user\Desktop\25F.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\25F.tmp.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_4-10911

Found evasive API chain (may stop execution after checking system information)

Source: C:\Users\user\Desktop\25F.tmp.exe

Evasive API call chain: NtQuerySystemInformation,DecisionNodes,ExitProcess

graph_4-10572

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\25F.tmp.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_4-10462

Source: C:\Users\user\Desktop\25F.tmp.exe	API coverage: 3.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	API coverage: 1.6 %

Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe TID: 680

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_006045E0 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	0_2_006045E0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_006045E0 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	2_2_006045E0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_0036F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	4_2_0036F130
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_0040F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	4_2_0040F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003DF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	9_2_003DF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_0018F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	10_2_0018F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_0038F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	11_2_0038F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_0041F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	12_2_0041F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001BF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	13_2_001BF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_0035F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	14_2_0035F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_0031F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	15_2_0031F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_0038F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	16_2_0038F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	17_2_0010F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	18_2_0010F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_0022F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	19_2_0022F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_0032F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	20_2_0032F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_0051F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	21_2_0051F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_0019F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	22_2_0019F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_0084F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	23_2_0084F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_0040F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	25_2_0040F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_0082F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	26_2_0082F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	27_2_0009F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005DF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	29_2_005DF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	30_2_0009F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_0091F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	31_2_0091F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_0039F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	32_2_0039F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_0009F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	33_2_0009F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_0022F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	34_2_0022F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_0015F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	35_2_0015F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007FF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	36_2_007FF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_0025F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	37_2_0025F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_0026F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	38_2_0026F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003FF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	39_2_003FF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003FF130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	40_2_003FF130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_0028F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	41_2_0028F130
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_0010F130 memset,memset,lstrcpyA,SetCurrentDirectoryA,FindFirstFileA,CoInitialize,_snprintf,FindNextFileA,strncmp,strstr,_snprintf,FindNextFileA,FindClose,	42_2_0010F130

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_0036F9E0 memset,GetLogicalDriveStringsA,lstrcatA,lstrcatA,

4_2_0036F9E0

Source: C:\Users\user\Desktop\25F.tmp.exe	API call chain: ExitProcess graph end node	graph_0-5164
Source: C:\Users\user\Desktop\25F.tmp.exe	API call chain: ExitProcess graph end node	graph_2-6620
Source: C:\Users\user\Desktop\25F.tmp.exe	API call chain: ExitProcess graph end node	graph_2-6167
Source: C:\Users\user\Desktop\25F.tmp.exe	API call chain: ExitProcess graph end node	graph_4-10263
Source: C:\Users\user\Desktop\25F.tmp.exe	API call chain: ExitProcess graph end node	graph_4-10254
Source: C:\Users\user\Desktop\25F.tmp.exe	API call chain: ExitProcess graph end node	graph_4-10259

Source: C:\Users\user\Desktop\25F.tmp.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\25F.tmp.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

graph_4-10955

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_00365A20 LdrEnumerateLoadedModules,CloseHandle,CreateThread,CloseHandle,CreateThread,CloseHandle,

4_2_00365A20

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 2_2_0040399B LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_0040399B

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00608A6C mov eax, dword ptr fs:[00000030h]	0_2_00608A6C
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00608A40 mov eax, dword ptr fs:[00000030h]	0_2_00608A40
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 0_2_00608A50 mov eax, dword ptr fs:[00000030h]	0_2_00608A50
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00608A6C mov eax, dword ptr fs:[00000030h]	2_2_00608A6C
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00608A40 mov eax, dword ptr fs:[00000030h]	2_2_00608A40
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_00608A50 mov eax, dword ptr fs:[00000030h]	2_2_00608A50
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 2_2_004015A0 movd mm0, dword ptr fs:[00000030h]	2_2_004015A0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_003635B0 mov eax, dword ptr fs:[00000030h]	4_2_003635B0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_004035B0 mov eax, dword ptr fs:[00000030h]	4_2_004035B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D35B0 mov eax, dword ptr fs:[00000030h]	9_2_003D35B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_001835B0 mov eax, dword ptr fs:[00000030h]	10_2_001835B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_003835B0 mov eax, dword ptr fs:[00000030h]	11_2_003835B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_004135B0 mov eax, dword ptr fs:[00000030h]	12_2_004135B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B35B0 mov eax, dword ptr fs:[00000030h]	13_2_001B35B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_003535B0 mov eax, dword ptr fs:[00000030h]	14_2_003535B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_003135B0 mov eax, dword ptr fs:[00000030h]	15_2_003135B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_003835B0 mov eax, dword ptr fs:[00000030h]	16_2_003835B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_001035B0 mov eax, dword ptr fs:[00000030h]	17_2_001035B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_001035B0 mov eax, dword ptr fs:[00000030h]	18_2_001035B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_002235B0 mov eax, dword ptr fs:[00000030h]	19_2_002235B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_003235B0 mov eax, dword ptr fs:[00000030h]	20_2_003235B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_005135B0 mov eax, dword ptr fs:[00000030h]	21_2_005135B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_001935B0 mov eax, dword ptr fs:[00000030h]	22_2_001935B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_008435B0 mov eax, dword ptr fs:[00000030h]	23_2_008435B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_004035B0 mov eax, dword ptr fs:[00000030h]	25_2_004035B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_008235B0 mov eax, dword ptr fs:[00000030h]	26_2_008235B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_000935B0 mov eax, dword ptr fs:[00000030h]	27_2_000935B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D35B0 mov eax, dword ptr fs:[00000030h]	29_2_005D35B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_000935B0 mov eax, dword ptr fs:[00000030h]	30_2_000935B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_009135B0 mov eax, dword ptr fs:[00000030h]	31_2_009135B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_003935B0 mov eax, dword ptr fs:[00000030h]	32_2_003935B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_000935B0 mov eax, dword ptr fs:[00000030h]	33_2_000935B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_002235B0 mov eax, dword ptr fs:[00000030h]	34_2_002235B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_001535B0 mov eax, dword ptr fs:[00000030h]	35_2_001535B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F35B0 mov eax, dword ptr fs:[00000030h]	36_2_007F35B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_002535B0 mov eax, dword ptr fs:[00000030h]	37_2_002535B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_002635B0 mov eax, dword ptr fs:[00000030h]	38_2_002635B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F35B0 mov eax, dword ptr fs:[00000030h]	39_2_003F35B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F35B0 mov eax, dword ptr fs:[00000030h]	40_2_003F35B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_002835B0 mov eax, dword ptr fs:[00000030h]	41_2_002835B0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_001035B0 mov eax, dword ptr fs:[00000030h]	42_2_001035B0

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_00363830 GetProcessHeap,HeapReAlloc,

4_2_00363830

Source: C:\Users\user\Desktop\25F.tmp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: C50000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 350000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 310000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 210000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 320000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 510000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 840000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 7F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 230000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 270000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 750000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 120000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 550000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 160000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory allocated: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior

Changes memory attributes in foreign processes to executable or writable

Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: C50000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: C50000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 350000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 310000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 210000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 210000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 320000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 320000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 510000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 510000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 840000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 840000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 7F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 230000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 270000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 750000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 120000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 550000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 160000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory protected: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 0_2_00609014 LoadLibraryA,LoadLibraryA,CreateProcessA,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_00609014

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_003642E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	4_2_003642E0
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: 4_2_004042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	4_2_004042E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 9_2_003D42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	9_2_003D42E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 10_2_001842E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	10_2_001842E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 11_2_003842E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	11_2_003842E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 12_2_004142E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	12_2_004142E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 13_2_001B42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	13_2_001B42E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 14_2_003542E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	14_2_003542E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 15_2_003142E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	15_2_003142E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 16_2_003842E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	16_2_003842E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 17_2_001042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	17_2_001042E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 18_2_001042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	18_2_001042E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 19_2_002242E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	19_2_002242E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 20_2_003242E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	20_2_003242E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 21_2_005142E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	21_2_005142E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 22_2_001942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	22_2_001942E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 23_2_008442E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	23_2_008442E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 25_2_004042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	25_2_004042E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 26_2_008242E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	26_2_008242E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 27_2_000942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	27_2_000942E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 29_2_005D42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	29_2_005D42E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 30_2_000942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	30_2_000942E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 31_2_009142E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	31_2_009142E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 32_2_003942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	32_2_003942E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 33_2_000942E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	33_2_000942E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 34_2_002242E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	34_2_002242E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 35_2_001542E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	35_2_001542E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 36_2_007F42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	36_2_007F42E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 37_2_002542E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	37_2_002542E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 38_2_002642E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	38_2_002642E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 39_2_003F42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	39_2_003F42E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 40_2_003F42E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	40_2_003F42E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 41_2_002842E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	41_2_002842E0
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: 42_2_001042E0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,GetLastError,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,CloseHandle,	42_2_001042E0

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe EIP: C55C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 3D5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 185C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 385C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 415C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 1B5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 355C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 315C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 385C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 105C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 105C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 225C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 325C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 515C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 195C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 845C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 405C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 825C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 95C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 5D5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 95C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 915C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 395C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 95C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 225C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 155C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 7F5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 255C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 265C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 3F5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 3F5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 285C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe EIP: 105C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 265C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 5D5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 1C5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 235C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 95C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 255C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 105C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 2A5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 275C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 2B5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 95C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 2D5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 155C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 755C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 125C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 555C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 255C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 2E5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 395C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 1B5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 105C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 385C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 825C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 385C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 3E5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 285C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 5F5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 2B5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 8A5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 105C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 1D5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 185C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 1C5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 8E5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 415C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 145C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 3A5C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 165C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 145C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 195C50	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Thread created: unknown EIP: 105C50	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtQueryInformationProcess: Direct from: 0x774CFAFA
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtQuerySystemInformation: Direct from: 0x774D20DE
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtClose: Direct from: 0x774CFA02
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtSetTimer: Direct from: 0x774D021A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtOpenFile: Direct from: 0x774CFD86
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtSetInformationThread: Direct from: 0x774E9893	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtCreateMutant: Direct from: 0x774D07BE
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtOpenKeyEx: Direct from: 0x774CFA4A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtAllocateVirtualMemory: Direct from: 0x774CFAE2
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtResumeThread: Direct from: 0x774D008D
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtOpenKeyEx: Direct from: 0x774D103A
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	NtUnmapViewOfSection: Direct from: 0x774CFCA2	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	NtDelayExecution: Direct from: 0x774CFDA1	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtSetInformationProcess: Direct from: 0x774CFB4A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtAdjustPrivilegesToken: Direct from: 0x774CFEE2
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	NtSetInformationThread: Direct from: 0x774CF9CE	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtMapViewOfSection: Direct from: 0x774CFC72
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtCreateThreadEx: Direct from: 0x774D08C6
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtDeviceIoControlFile: Direct from: 0x774CF931
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtQueryValueKey: Direct from: 0x774CFACA
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtTerminateThread: Direct from: 0x774D00A6
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtOpenSection: Direct from: 0x774CFDEA
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtProtectVirtualMemory: Direct from: 0x774D005A
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtSetInformationThread: Direct from: 0x774CFF12
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtWriteVirtualMemory: Direct from: 0x774CFE36
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtQueryAttributesFile: Direct from: 0x774CFE7E
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtReadVirtualMemory: Direct from: 0x774CFEB2
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtSetTimer: Direct from: 0x774E98D5	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	NtTerminateProcess: Direct from: 0x774CFCD2	Jump to behavior
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	NtQuerySystemInformation: Direct from: 0x774CFDD2

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Users\user\Desktop\25F.tmp.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Users\user\Desktop\25F.tmp.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: C50000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 350000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 310000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 320000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 510000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 840000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 910000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 7F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 230000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 270000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 750000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 120000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 550000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 160000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: C50000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3D0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 350000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 310000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 210000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 320000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 510000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 840000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 910000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 220000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 7F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 260000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5D0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 230000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2A0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 270000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2D0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 150000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 750000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 120000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 550000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 250000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2E0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 390000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1B0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 90000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 820000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 380000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3E0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 280000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 5F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 2B0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8A0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1D0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 180000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 1C0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: C0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 8E0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 3A0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 80000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 160000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 130000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 140000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: F0000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 190000	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Memory written: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe base: 100000	Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Users\user\Desktop\25F.tmp.exe C:\Users\user\Desktop\25F.tmp.exe	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Windows\notepad.exe "C:\Windows\notepad.exe"	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Users\user\Desktop\25F.tmp.exe C:\Users\user\Desktop\25F.tmp.exe	Jump to behavior
Source: C:\Users\user\Desktop\25F.tmp.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"	Jump to behavior

Source: QgGhoOpxHPl.exe, 00000009.00000000.384034855.0000000001260000.00000002.00000001.00040000.00000000.sdmp, QgGhoOpxHPl.exe, 00000009.00000002.624311663.0000000001260000.00000002.00000001.00040000.00000000.sdmp, QgGhoOpxHPl.exe, 0000000A.00000002.624230565.0000000001260000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: QgGhoOpxHPl.exe, 00000009.00000000.384034855.0000000001260000.00000002.00000001.00040000.00000000.sdmp, QgGhoOpxHPl.exe, 00000009.00000002.624311663.0000000001260000.00000002.00000001.00040000.00000000.sdmp, QgGhoOpxHPl.exe, 0000000A.00000002.624230565.0000000001260000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: QgGhoOpxHPl.exe, 00000009.00000000.384034855.0000000001260000.00000002.00000001.00040000.00000000.sdmp, QgGhoOpxHPl.exe, 00000009.00000002.624311663.0000000001260000.00000002.00000001.00040000.00000000.sdmp, QgGhoOpxHPl.exe, 0000000A.00000002.624230565.0000000001260000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_006047B8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_006048C3
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,GetACP,	0_2_00607C80
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,	0_2_00606ADC
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,	0_2_00606B28
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,	0_2_00604BC8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	2_2_006048C3
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,GetACP,	2_2_00607C80
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,	2_2_00606ADC
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,	2_2_00606B28
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetLocaleInfoA,	2_2_00604BC8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	2_2_006047B8
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	4_2_0036B480
Source: C:\Users\user\Desktop\25F.tmp.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	4_2_0040B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	9_2_003DB480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	10_2_0018B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	11_2_0038B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	12_2_0041B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	13_2_001BB480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	14_2_0035B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	15_2_0031B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	16_2_0038B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	17_2_0010B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	18_2_0010B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	19_2_0022B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	20_2_0032B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	21_2_0051B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	22_2_0019B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	23_2_0084B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	25_2_0040B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	26_2_0082B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	27_2_0009B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	29_2_005DB480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	30_2_0009B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	31_2_0091B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	32_2_0039B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	33_2_0009B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	34_2_0022B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	35_2_0015B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	36_2_007FB480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	37_2_0025B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	38_2_0026B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	39_2_003FB480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	40_2_003FB480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	41_2_0028B480
Source: C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe	Code function: memset,lstrcpyA,lstrcpyA,HeapAlloc,GetVersionExA,lstrcpyA,HeapAlloc,strstr,lstrlenA,lstrlenA,GetLocaleInfoA,lstrcmpA,GetLocaleInfoA,GetLocaleInfoA,lstrcpyA,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,HeapAlloc,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,_snprintf,lstrcpyA,_snprintf,_snprintf,??3@YAXPAX@Z,	42_2_0010B480

Source: C:\Users\user\Desktop\25F.tmp.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_0036E880 memset,lstrlenA,_snprintf,CreateNamedPipeA,CreateNamedPipeA,CloseHandle,ConnectNamedPipe,GetLastError,CreateThread,CloseHandle,CreateNamedPipeA,

4_2_0036E880

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 4_2_00361AD0 GetSystemTimeAsFileTime,

4_2_00361AD0

Source: C:\Users\user\Desktop\25F.tmp.exe

Code function: 0_2_00604C91 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

0_2_00604C91

Source: C:\Users\user\Desktop\25F.tmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	31 Native API	2 Bootkit	1 Access Token Manipulation	1 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	713 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	1 Access Token Manipulation	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Browser Session Hijacking	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	713 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	125 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bootkit	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Software Packing	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
25F.tmp.exe	100%	Avira	TR/Injector.VS
25F.tmp.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
code.jquery.com	151.101.2.137	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
assets.msn.com	unknown	unknown	false	high
www.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://sb.scorecardresearch.com/b2?rn=1735632299605&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=0B7EB9A71D6D654F0B8CACC11CC56471&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://code.jquery.com/jquery-3.6.3.min.js	false	high
https://sb.scorecardresearch.com/b?rn=1735632299605&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=0B7EB9A71D6D654F0B8CACC11CC56471&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.msn.com/?ocid=iehp	{E68EA6F6-C74D-11EF-8F38-ECF4BBB5915B}.dat.6.dr, ~DF854EA4F5FD60E78B.TMP.6.dr	false	high
http://api.wipmania.com/	QgGhoOpxHPl.exe, 0000002A.00000002.620410514.0000000000100000.00000040.00000400.00020000.00000000.sdmp	false	high
https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js	YJ1BHFNR.htm.24.dr	false	high
https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js	YJ1BHFNR.htm.24.dr	false	high
https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js	YJ1BHFNR.htm.24.dr	false	high
https://www.msn.com/fr-ch/actualite/other/Mentions-l	experience.b374b0d5b40196862f17[1].js.24.dr	false	high
https://www.msn.com/favicon.ico	imagestore.dat.24.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
151.101.2.137	code.jquery.com	United States		54113	FASTLYUS	false
18.244.18.38	sb.scorecardresearch.com	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582673
Start date and time:	2024-12-31 09:03:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	33
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25F.tmp.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/38@6/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 400
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 184.28.89.167, 204.79.197.203, 23.72.248.199, 23.72.248.211, 23.72.248.200, 23.72.248.206, 23.72.248.210, 23.72.248.201, 23.72.248.204, 23.72.248.198, 23.72.248.207, 13.107.5.80, 2.22.251.24, 2.22.251.30, 2.22.251.41, 2.22.251.22, 2.22.251.42, 2.22.251.23, 2.22.251.40, 2.22.251.35, 2.22.251.25, 184.86.251.19, 184.86.251.9, 184.86.251.21, 184.86.251.22, 184.86.251.27, 184.86.251.7, 184.86.251.13, 184.86.251.20, 13.74.129.1, 20.42.65.85, 13.107.21.237, 204.79.197.237, 152.199.19.161
Excluded domains from analysis (whitelisted): www.bing.com, assets.msn.com.edgekey.net, c-msn-com-nsatc.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ie9comview.vo.msecnd.net, api.bing.com, a-0003.a-msedge.net, onedscolprdeus05.eastus.cloudapp.azure.com, www-msn-com.a-0003.a-msedge.net, r20swj13mr.microsoft.com, www-www.bing.com.trafficmanager.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, e-0001.e-msedge.net, go.microsoft.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, c.bing.com, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, global.asimov.events.data.trafficmanager.net, e28578.d.akamaiedge.net, api-bing-com.e-0001.e-msedge.net, cs9.wpc.v0cdn.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:04:47	API Interceptor	87x Sleep call for process: 25F.tmp.exe modified
03:04:50	API Interceptor	12328x Sleep call for process: QgGhoOpxHPl.exe modified
03:05:17	API Interceptor	1x Sleep call for process: WmiPrvSE.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.2.137	http://novo.oratoriomariano.com/novo/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://applela.za.com/isignesp.php?id=	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://awqffg.newburuan2023.biz.id/next.php	Get hash	malicious	HTMLPhisher	Browse	code.jquery.com/jquery-1.10.2.min.js
18.244.18.38	WSock.dll	Get hash	malicious	Ramnit	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	151.101.2.137
	EFT Payment_Transcript__Survitecgroup.html	Get hash	malicious	Unknown	Browse	151.101.2.137
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	Hwacaj.exe	Get hash	malicious	Darkbot	Browse	151.101.66.137
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4u	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	phish_alert_iocp_v1.4.48 - 2024-12-26T092852.527.eml	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://contractnerds.com/	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://booking.extranetguests.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.194.137
sb.scorecardresearch.com	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	18.244.18.122
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	18.161.69.30
	Hwacaj.exe	Get hash	malicious	Darkbot	Browse	18.161.69.8
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	18.161.69.117
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	18.165.220.110
	installer.bat	Get hash	malicious	Vidar	Browse	18.165.220.106
	skript.bat	Get hash	malicious	Vidar	Browse	18.165.220.66
	din.exe	Get hash	malicious	Vidar	Browse	18.165.220.66
	lem.exe	Get hash	malicious	Vidar	Browse	18.165.220.57
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	18.244.18.32

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	chernobyl.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	34.241.139.243
	ARMV7L.elf	Get hash	malicious	Mirai	Browse	54.247.62.1
	systempreter.exe	Get hash	malicious	AsyncRAT	Browse	3.69.157.220
	http://ghostbin.cafe24.com/	Get hash	malicious	Unknown	Browse	13.32.99.103
	rjnven64.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	18.245.31.129
	Epsilon.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	54.168.12.166
FASTLYUS	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.214.172
	Epsilon.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188	Get hash	malicious	KnowBe4	Browse	199.232.192.193
	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	199.232.188.157
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Supplier.bat	Get hash	malicious	Unknown	Browse	185.199.110.133
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.199.111.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	Hwacaj.exe	Get hash	malicious	Darkbot	Browse	151.101.2.137 18.244.18.38
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	151.101.2.137 18.244.18.38
	Pago.xls	Get hash	malicious	AveMaria, UACMe	Browse	151.101.2.137 18.244.18.38
	NB PO-104105107108.xls	Get hash	malicious	Unknown	Browse	151.101.2.137 18.244.18.38
	PyrNUtAUkw.docx	Get hash	malicious	Unknown	Browse	151.101.2.137 18.244.18.38
	SLNA_Updated_Medical_Grant_Application(1).docx	Get hash	malicious	Unknown	Browse	151.101.2.137 18.244.18.38
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	151.101.2.137 18.244.18.38
	Cot90012ARCACONTAL.xls	Get hash	malicious	Remcos	Browse	151.101.2.137 18.244.18.38
	Estado.de.cuenta.xls	Get hash	malicious	AveMaria, UACMe	Browse	151.101.2.137 18.244.18.38
	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	151.101.2.137 18.244.18.38

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\MP98E46N\www.msn[1].xml

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	4.936916038399468
Encrypted:	false
SSDEEP:	3:D9yRtFwsSxzqC+eAsOFETYHFk6YRmhJAqTUCfZKaKb:JUF+FqCqdFFYRpUkb
MD5:	DACB549C576CC47323C10066AA00162E
SHA1:	99C1E7789E6A81ACD94F7782F8A8307F96E02AAC
SHA-256:	C02E4C56295FA7615B69128C0CC094D07750F926934F12EDDA3B751BCE7B82DD
SHA-512:	DD1F3303032E7F7C21DCCDF178A51765FA33C31B327D5A2A2C06FA64752B196EFB62E62FE57C638EDB2A0A053D837C8B7FF55FDCC115B8833447C272AAB49E7B
Malicious:	false
Preview:	<root><item name="pageVersions" value="{"hp":"20241220.296"}" ltime="2949094144" htime="31152986" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E68EA6F4-C74D-11EF-8F38-ECF4BBB5915B}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.053920544598572
Encrypted:	false
SSDEEP:	24:rewWGo/QByNgGW/1yNOyN8ZyN1NlWgK1NlWg:r2Go4ByKGW9yYySZyigKQg
MD5:	3064CFFECA40DEF9B5608C0E522D22BF
SHA1:	91A3520A316043C1F019FEB762DB299EF4D3809C
SHA-256:	FC647EA756DE14F181054AE7F9B70435D52CD3242547CE8E6AE9845085E70BD6
SHA-512:	B567BC9399F2CDA6D144268719D115B736DEC56DDC477BFD327E743CD6FA3511224067A3E47C43ED2A36A2D8A89DE99DA92B7ABAD5F1961978B6712FACF3826E
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................X.Z[................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.9.a.a.O.5.k.3.H.7.x.G.P.O.O.z.0.u.7.W.R.W.w.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E68EA6F6-C74D-11EF-8F38-ECF4BBB5915B}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.2139276544593613
Encrypted:	false
SSDEEP:	24:rEGDdARHQNljFZyMuKvqy6yEyvy5DlsN5AcwNljFZyMXvqy:rEGpARAFZLuKS9LYu0O7FZLXS
MD5:	BFCFFF68E5325944BDB31A678EF8EB80
SHA1:	A90A83FA8A6ED0B91A6D4B744D26675DED381F4F
SHA-256:	548113CB3CCB336AEA7179E4C7B97F8C0094809A1E829A93877B95959B170C6A
SHA-512:	512024EBFFB363FCD51BE73CAE2D11CE14FC8C2850C44EE4C14840684C344B306C2F0905162BB0DA373C915AFED6F22616733DF20DE916A39D42DA8C9E6E0362
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................@..Z[................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	6006
Entropy (8bit):	6.3542973412192145
Encrypted:	false
SSDEEP:	96:/zS29dcBUXqQVObIg0ZFY2q7UYWIzFhJFYo6syPYmSTZYVVQQT/VfygNV:/zSAcBKjg0jYh7TWqFpzTTGjT/Vfym
MD5:	5602C5E0C99260FCAC3F99E850BC6A80
SHA1:	3DC7BF03C5E8B8F3D8508FC588DF85FEC4F9C56D
SHA-256:	0935F12421E0A71E26C0208268225253235A9C8FAA45DDEDD4C9C33730A6A9DE
SHA-512:	CD3CA9A12740C63F5CF403F38365C1D8D166735220F7E1587B53C93118FECA4CEF3E273B86110720B97F210F1785B41559B6C9DC632BA4C83E14A890A072492A
Malicious:	false
Preview:	........D.h.t.t.p.:././.s.t.a.t.i.c.-.g.l.o.b.a.l.-.s.-.m.s.n.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.h.p.-.n.e.u./.s.c./.2.b./.a.5.e.a.2.1...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D..M..............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q\|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq\|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`. ... .............._......._....D.h.t.t.p.:././.s.t.a.t.i.c.-.g.l.o.b.a.l.-.s.-.m.s.n.-.c.o.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\Icon[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	533
Entropy (8bit):	7.415663553371965
Encrypted:	false
SSDEEP:	12:6v/7Ya7/6Ts/o7hJW8/t8oX8qUkUGGVIXC/zoZ3VYZwWSVR:E/6pzWK+q/UGGMC/zw3oGVR
MD5:	B6162D100379E7F4EF709BA5C26D1BA8
SHA1:	AEA4244C56F00AA26064134863157A6EE9D7ABB9
SHA-256:	DCA74022BEBB4F12F8EFADD226C9413CAFFF9193420D604DE8A398642172AACA
SHA-512:	CC64207C45F85255F34A157C9370A46EBD4A2B3A674E639838EF7582FD93D68F91A275C577E2FC9A46674EC765D8CC43A5BE28B281FCD5006D38D0C6F02E2058
Malicious:	false
Preview:	.PNG........IHDR...<... .....N.......pHYs.................sRGB.........gAMA......a.....IDATx..=O.1....$....1..7.....p32..)..Yw..p..IL.$qT'......1.#.h..j.5...9...~...w.....oe.....]8,..\|..........``.$a.K.&Lq........D,D..8e.c.....fQ...u..%.(..b..8A......,>@6....Y*...9.(...d7........,!zr.N...T}.....j...NY'..\|.=N2Q&<?3....@..-.e.h....F#..2.v...n..!-.e..&........%.e........y.c.y,.e........4'40.t"...B.........D.../[D..6j....^>.....g...3...5<Hv.H../M.+Y`.......OXw<a.al..aF.@.../.E....=;S.K....s.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\YJ1BHFNR.htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (58335), with CRLF line terminators
Category:	dropped
Size (bytes):	193378
Entropy (8bit):	5.451282730098038
Encrypted:	false
SSDEEP:	3072:DZRDgfyd5FO93Qiq6I8khsNyh/P9OZ8TixYE:zgfyA93Qx6I8hNyhX91OxYE
MD5:	C1DD7EB29B861DE41A3735EF212AE152
SHA1:	CE30E5303ED8B78E3CB42573496DA9DB72F9BCBE
SHA-256:	73768C4FB5E903A294A48B9713790FD3ECD8C025B444590E76C235FB42DDCE37
SHA-512:	ED5058F68F69CE4BA79FC87944C65845914EEF8297AF122889E4ECC91E1FC510E37D7A8A92F5AFAF396EFAED5513987FCFB7632B11BB9E1EC16E2EA6AE89362C
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,pnpwxexpire-c,bing_v2_scope,prg-cg-crosaloc1,prg-adspeek,prg-pr2-widget-tab,prg-pr2-marketsel-c,routeugcexp,1s-fcrypt,prg-wpo-pnpc,1s-ntf2-evlcfc,1s-ntf2-bknlc,1s-ntf2-iptlc,1s-pr2-evlc,1s-pr2-evlcbb,1s-pr2-evlch,1s-pr2-evlcn,1s-pr2-evlcrp,1s-pr2-evlct,1s-prg2-lifecycle,1s-wpo-pr2-ncard,1s-wpo-pr2-pnpfilter,1s-wpo-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,1s-rpssecautht,jj_fac_t,prg-pr2-pred-dyf,chatn_v2_t2,prg-pr1-uc-no-store-t,1s-p1-promotedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-promad,prg-1unified-no-store,2412-i-ncnf-t,1s-notifmapping,1s-shp-rc-t-decu1,1s-shp-rc-ta-dctime,1s-shp-rc-ta-decay,1s-shp-rc-ta-decu1,1s-shp-rc-ta-initw,1s-shp-rc-ta-lam01,1s-shp-rc-ta-min1,1s-shp-rc-ta-min4,prg-sh-frnrc,prg-wx-dhgrd,prg-sh-de

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\common.802715d7a736bd82fc74[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	265561
Entropy (8bit):	5.432386621514022
Encrypted:	false
SSDEEP:	3072:Hw+voYPbYRFKstM4weHKyhqGF0/UnwQXXiR4U2JH5:HLvoMKkstM4wBVUnjJZ
MD5:	1C984AC84FC70C69942DF2AD7CD7933E
SHA1:	61A5C268E80AF49D161ADD6B6EE0DB6FC02EB6EA
SHA-256:	8D7E6CE8CC3594239246D481140C43546A2058B5B75DCA2048389C3713B9FE15
SHA-512:	1B19BC2DC7CDFD89A5657D0BDB9D9E63F6396994426780241E2F5F7669ECCFE4102814593A0E15170349F7340062D29AD8750B4B5DA43E63D624E3BA64F2FE98
Malicious:	false
Preview:	"use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks\|\|[]).push([["common"],{54085:function(e,t,n){var r;n.d(t,{p:function(){return r}}),function(e){e.Desktop="desktop",e.Phone="phone",e.Tablet="tablet"}(r\|\|(r={}))},21290:function(e,t,n){n.d(t,{GB:function(){return s},Km:function(){return c},Oq:function(){return f},Sp:function(){return d},Wc:function(){return u},cm:function(){return p},e_:function(){return g},oH:function(){return h},r7:function(){return a},yL:function(){return l}});var r=n(45331),i=r.z.Alert,o={build:""};function a(e){Object.assign(o,e)}var s={id:22012,severity:i,pb:o},c={id:22014,severity:r.z.Critical,pb:o},u=(r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,{id:22027,severity:r.z.Critical,pb:o}),l=(r.z.Critical,r.z.Critical,{id:22031,severity:i,pb:o}),p={id:22032,severity:i,pb:o},d={id:22033,severity:i,pb:o},f={id:22034,severity:i,pb:o},h={id:22050,severity:i,pb:o},g={id:22051,severity:r.z.Deprecated,pb:o};r.z.De

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\experience.b374b0d5b40196862f17[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (62058), with no line terminators
Category:	dropped
Size (bytes):	231602
Entropy (8bit):	5.762554862752807
Encrypted:	false
SSDEEP:	1536:Bl4m9Uoyafb1Hjhw3dsrWnQHdiJg7hJ5BjNnaAyGJNyWVzskeUjlWSGu9bCxKYb1:Mm9r0g9KAvyWs7Gb9+Fb1Zzae
MD5:	3ACCB914F415F2E2C36775D5783CF112
SHA1:	7CB1F2677020EAFEAF7BFCCF2E15BC7DC45DC758
SHA-256:	D3722105B5C0D92A3E85ECA10174193CD0AF84DE74586B2EEE991182CFF5AFFE
SHA-512:	3024450B40BBF7F3482F465BC831E4826543DE5D6A634584AAE7C5EA4B72D8F6E75A675D9371BF92303E051BFF94ACE431A082D8BD5E89CB664FC0DEF41DB19B
Malicious:	false
Preview:	!function(){"use strict";var t,e,n,r={12451:function(t,e,n){var r=n(8460),i=n(2132),a=n(82589),o=n(9925),s=n(96838),c=n(56595),l=n(54616),d=n(82512),u=n(3290),f=n(8488),p=n(4577),m=n(4108),g=n(23159),h=n(65212),v=n(27310),b=n(54085),x=n(29714),y=n(3460),w=n(91898),k=n(42390),C=function(){function t(){}return Object.defineProperty(t,"viewType",{get:function(){return x.Gq.get(this.viewTypeKey)},set:function(t){x.Gq.set(this.viewTypeKey,t)},enumerable:!1,configurable:!0}),t.trackCallbacks=function(){switch((0,y.Bn)().currentColumnArrangement){case w.K$.c1:case w.K$.c2:t.viewType="size2column";break;case w.K$.c3:t.viewType="size3column";break;case w.K$.c4:t.viewType="size4column"}return t.viewType},t.getTelemetryProperties=function(t,e){var n=!("false"===k.c.getQueryParameterByName("enableTrack",e)),r=k.c.getQueryParameterByName("ocid",e)\|\|"hpmsn",i=u.jG.ActivityIdLowerCaseNoHypens,a="0",o=!1;if(d.Al&&d.Al.ClientSettings){var s=d.Al.ClientSettings;"true"===s.static_page&&(o=!0),a=s.browser

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\microsoft.b109cceab5e009228460[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (65448)
Category:	dropped
Size (bytes):	94707
Entropy (8bit):	5.407635683386335
Encrypted:	false
SSDEEP:	768:GSqLAEwLuZAFL1oL3SDk5v1VWkNWPEYydLLnnS+7ySGAEMbiYnRGwVKVt+RFVDh4:GJMCUCuW3WkNtnnDGgGwVKWklyGEQ
MD5:	AA2BEDDF57312EF1CD312880E2729EBA
SHA1:	8E53B59585F8C947924355AFDC72A62E27CD001C
SHA-256:	16933DCF75634F75F0A09A67FB0FF7D9D0556188A888CDD89E05F2D21997BB51
SHA-512:	64AC2CCE15619DA127C5F1B637BBB39C1EB3DB69DE30FB690863C7390EC0A6D0BA2BEE9B9BC20DFF2B4044D17CED483CE5294E624F792652E8E4E1AD6FFAD4DD
Malicious:	false
Preview:	/! For license information please see microsoft.b109cceab5e009228460.js.LICENSE.txt /."use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks\|\|[]).push([["microsoft"],{39115:function(n,e,t){t.d(e,{Z:function(){return M}});var r=t(68897),i=t(44611),o=t(89734),u=t(98693),a=t(38629),c=t(64648),f=t(73966),s=t(64973),l=t(26105),d=t(46540),v=500,p="Channel has invalid priority - ";function g(n,e,t){e&&(0,f.kJ)(e)&&e[c.R5]>0&&(e=e.sort((function(n,e){return n[s.yi]-e[s.yi]})),(0,f.tO)(e,(function(n){n[s.yi]<v&&(0,f._y)(p+n[c.pZ])})),n[c.MW]({queue:(0,f.FL)(e),chain:(0,l.jV)(e,t[c.TC],t)}))}var h=t(27218),m=t(24200),y=t(92687),b=t(28055),S=function(n){function e(){var t,r,a=n.call(this)\|\|this;function l(){t=0,r=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,l(),(0,i.Z)(e,a,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.MW](e),{remove:function(){(0,f.tO)(r,(function(n,t){if(n.id===e.id)return r[c.cb](t,1),-1}))}}},n[s.hL]=fu

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vendors.290823e0e7160e8e5303[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (44387), with NEL line terminators
Category:	dropped
Size (bytes):	194844
Entropy (8bit):	5.419132326845799
Encrypted:	false
SSDEEP:	3072:oSYgu0Mj/PJ3floxEsQtzbwDZ777/3DwLps0p:oSYguVJvSa5+Z7uOE
MD5:	1C8B7CFD513B7ECA52BA64947CEE70E4
SHA1:	6BA3FBE2E7514E981EB68E9A92E9EA7A499CCC0C
SHA-256:	D1730E14E7E3D2362E6C5FF0C9C36E08660F87317EC44551FAED419263240F2C
SHA-512:	1F6567D3870CFBE002CD447135020C9F1319DFAB76E3CEAFE4C62BDD79F78F2AB3E5958DE9E068A3937E1C469978FC2E4A56015B82E06FE1377A78B47D1B06DC
Malicious:	false
Preview:	"use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks\|\|[]).push([["vendors"],{29558:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},74322:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(String(t)+" is not a function");return t}},25135:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t)&&null!==t)throw TypeError("Can't set "+String(t)+" as a prototype");return t}},6664:function(t,e,r){var n=r(23362),o=r(35093),i=r(79549),a=n("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},99027:function(t,e,r){var n=r(58306).charAt;t.exports=function(t,e,r){return e+(r?n(t,e).length:1)}},57699:function(t){t.exports=function(t,e,r){if(!(t instanceof e))throw TypeError("Incorrect "+(r?r+" ":"")+"invocation");return t}},45150:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t))throw TypeError(String(t)+" is not an object");return t}},60410:function(t){t.exports=

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\favicon[1].ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\favicon[2].ico

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.912342955561912
Encrypted:	false
SSDEEP:	96:YY2q7UYWIzFhJFYo6syPYmSTZYVVQQT/VfygN6:YYh7TWqFpzTTGjT/VfyZ
MD5:	A73B8189E32D3A97AE2FBF1A57931D49
SHA1:	560A8EA628A89A82233BF4288166B54789242966
SHA-256:	855F6B5EEA22A22F5F4ABCCEEED4B8969EFB3A99443036EB5EB64F5F46C8FD8E
SHA-512:	2B016E28A7E63DE8FCAD90DDB38CCD5D875A22CF53D723E055B7C7C9B7589CB818883234C6682CA25112AF3CB4BA61A1AED384C1638C04905FC6FAFDD37F79A4
Malicious:	false
Preview:	...... .... .........(... ...@..... .................................G..."...?..<2...)...'...-...8..uD...@...8...............2...2...1...1...2...4...7...6.......................................T...Q...S..J...@...9...7...:...B...K...U.\|/G...[.r.....C...=...?..c@...D...E...D...D..{]...H...................................i.a.:...].p.U.{.N...H...F...H...L...S.~.\.q.f.c4`.h...g.R...O...P...S...V...V...U...S...S.. T...................................m.V.o.R.i.^.a.j.Z.u.T.}.R...S...V.z.\.q.e.e.l.V.i.E j.H.Y...Y...Z...Z...Z...Z...Z...Y...Y..KY...................................g.E.e.A.j.K.k.X.f.c.`.k.^.o.^.n.a.j.f.c.l.X.h.H.[.5.E...U...[...[...[...Z...Z...Z...Z...Z..cZ...................................Z.5.N.(.[.6.d.B.k.P.k.X.j.].j.].k.Z.m.S.h.H.\.7.M.$.@..SK.8.]...Z...[...[...[...[...[...[..d[...................................M.&.L.#.L.#YR..].7.d.B.h.H.j.I.h.G.c.?.Z.4.N.%.?...=...}h....}.yb.\y..Z...[...[...[...[..Q[.......................................A...@...B...I...Q.(.V./.X.1.V.0.Q.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\jquery-3.6.3.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89947
Entropy (8bit):	5.290839266829335
Encrypted:	false
SSDEEP:	1536:ENjxXU9rnxD9o5EZxkMVC6YLtg7HtDuU3zh8cmnPMEgWzJvBQUmkm4M5gPtcNRQK:EcqmCU3zhINzfmR4lb3e34UQ47GKL
MD5:	CF2FBBF84281D9ECBFFB4993203D543B
SHA1:	832A6A4E86DAF38B1975D705C5DE5D9E5F5844BC
SHA-256:	A6F3F0FAEA4B3D48E03176341BEF0ED3151FFBF226D4C6635F1C6039C0500575
SHA-512:	493A1FE319B5C2091F9BB85E5AA149567E7C1E6DC4B52DF55C569A81A6BC54C45E097024427259FA3132F0F082FE24F5F1D172F7959C131347153A8BCA9EF679
Malicious:	false
Preview:	/! jQuery v3.6.3 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\desktop-shape[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 7 x 13, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.986656121330302
Encrypted:	false
SSDEEP:	3:yionv//thPlyyta2/uDlhlp8Lts7CX9/2yx24lSXqU3hjg/BFCb0cCHxlbVdMaW9:6v/lhP1b/6TsR/R0Zjgz89CXVdMndp
MD5:	34760615AB0C180EB4B48739297FD0F2
SHA1:	789438D09CC27A08879B1A9686C82527270E7C24
SHA-256:	360C33D59E7358579601909D4CE91F1BCABF9E07BEB8F69D50C226D7D8F91260
SHA-512:	1CE7E574D45D123C6B52119907E74D71B842F1CC380D79AEF876FDBC9FDB663F385BB4191650813D2E66EFE24265FD36EC944AF95F372C0413EDCF11361CA666
Malicious:	false
Preview:	.PNG........IHDR.............e.t.....pHYs.................sRGB.........gAMA......a....ZIDATx......@.EA.`...U..1\.......X]...G..{..HU.4Uj.`..O .3;..\..!3...q....[s./.@@..p...>.`(k..2.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ie-image[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1260 x 293, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39155
Entropy (8bit):	7.8985187905985486
Encrypted:	false
SSDEEP:	768:c3+SnZXFurjYW0X0RJ/Dd18i72A/qcQ6Nj2CG+CiTZ2co4IXnmDt:DSnZXFuPSX0f837cQnCG+3WZXmx
MD5:	E161E2045A32E4513E81954B1D83B953
SHA1:	0A06306203C286B8C342CFD856C1EE3F16728C7E
SHA-256:	7A344D69BC6657592E6041F0ED4F53F56ABA90B97EBD94559198B1D059DC7F64
SHA-512:	7C7E5C2D2A0DF749BB4B52F2E8042829AE8ADD4F242674E13C14FEC436E56D7B173318D8408DD5A33462D38BC1FD2AD932B2060994B5A0C46F4B4BA89922437F
Malicious:	false
Preview:	.PNG........IHDR.......%.....W.}^....pHYs.................sRGB.........gAMA......a.....IDATx.....diz..}.c._..W.7..Nc\..,@...]I w..")..DI+.!.6......A?2......pI`....{.........&.9...s2o...2Y5..0;.I{O..\|.<.#...?. """""""".............&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\logo[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1633 x 708, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27928
Entropy (8bit):	7.701164569435742
Encrypted:	false
SSDEEP:	768:xSufGKAfaoovahBv4apFM4lvzDpqFosGd+Up9FIK0B:jfUMve54E//fCiIK0B
MD5:	862D29153222B9B15C3C73B61B930335
SHA1:	391BEBF4BA8910B718C5516491EB1C7D32D4C187
SHA-256:	3EC8FA41DCE2684102F4A7B2D993388809CC2F6AE0616807CA9E3D94E6D19AC2
SHA-512:	6FFCB08DE27DFA571C8EF35E7F017F2871482581308C10CF38EFF9A507D02325222B899D667FC86227C2985ACA05F17C1CD33EF4163BE3442F70F8907BD78404
Malicious:	false
Preview:	.PNG........IHDR...a.................pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<..l.IDATx....u.7.0.A......@...T`o.f.SA...T`...+0UA..BU.X....a,.......u..:.%..`... ..........a. ......................N.....o..z..=.....r!..^..Rr.....J..b.{..x...9^....u.^.?+.......!..kQ`.....$YNo\/..km.4.n...........1H.0\e.$]^w..K.^....r{I......0.I.v.@!...6.r\..JI..n..9W......<.$.O.0.3]...W.\|..n.B&%c.)......cI...e.K.^4....ZX!......C$a..rl.x....\|%..I...x.]........I..m..a.?.vml76.O.:.lW........0\|..!.M..D4.%..Yt..1+......h.$........w..c.B......&I..._.e..R.%c......#..b.K...d.....@c$aZ....&..R4.F2........0-.r..n.\|y#..H.Y..VB.....P....n!......MZ..W,.E.........>V..Z.!..E.ND#{..:...\(......!.Sc..0....Dq....eK......(.$LM.i.K->t.d.g......(.3a*.~.......x.b........\V.^..C...A.....Y......@Y..)X.a.?V..L.R.^.~+......e..)T....x....2.=..y..............L./..!..:^..}.........Y.S...i.Xv.0-K.b>.p&......y.......r..~./>u.U1+........0..!.:..x]...Z(......#.....<~.....s..........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mobile-image[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 375 x 180, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23972
Entropy (8bit):	7.983082688064765
Encrypted:	false
SSDEEP:	384:OQCmhN3Hqqm87sSOvS8PJKCqedNV7TMzNjdpNQsjtHnUSQkBmSfYuoq9Dgt:dCmr3KqmIdO68MAnnWNjdpBSSQVfWDgt
MD5:	64C4757048F068394817EE126FDBA8A6
SHA1:	3610DC2EB5E3C09809E94BD0694A06C7A51580FF
SHA-256:	A9FEC8F56726ECA81D0600220A6B168FFF112A5283741FD5EC63509AEDBB51D5
SHA-512:	373EE45E16D231B2FF8A897A357A52A58B63430E0BCF728867879F2E10E55C631589D6F63C1675E2E40EB1EF7CEB59B15DF18013EA0F3FA352A3B36296F14DAB
Malicious:	false
Preview:	.PNG........IHDR...w.........o.lP....pHYs.................sRGB.........gAMA......a...]9IDATx..g.$Wv&....H_......n......1...g..r.IQg.]..?:gWG.;....s.#........;.!....a`f..n.h...].dV...{.......j.C........\|..}......................G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 .8lh...5.Hn.R......j'R.;\|j!..I\7...Z..G...BhB.<}.....G..X..-...w"..]f.v~..+.HI...#._.k.S.k!t...n..;...6..`...G...L...../...1...Hz..:.....j........a.."..M...(..u.L..+m.3.">....i..pq..v.!..p...m7.gH\.v.{.....j,@...w:@.......v.....>).w.......G.r..LKmE.@........K...v0^........v..b...ja....@t`..u.......{D...}./}...}g.NN. 6..]...PS2.q.Ge<..v ..D....B..B.V...D!.T...@>G.....u.m4.Z.XZ.\X...j..F.Y@.... .."z....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\urlblockindex[1].bin

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	1.6216407621868583
Encrypted:	false
SSDEEP:	3:PF/l:
MD5:	FA518E3DFAE8CA3A0E495460FD60C791
SHA1:	E4F30E49120657D37267C0162FD4A08934800C69
SHA-256:	775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
SHA-512:	D21667F3FB081D39B579178E74E9BB1B6E9A97F2659029C165729A58F1787DC0ADADD980CD026C7A601D416665A81AC13A69E49A6A2FE2FDD0967938AA645C07
Malicious:	false
Preview:	.p.J2...........

C:\Users\user\AppData\Local\Temp\~DF3A6EF28F490D6D3E.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.4563290525575383
Encrypted:	false
SSDEEP:	6:ioivqdXtQQaqdXy4UFAlkxYaqdXvwvqdXUGlJ8mX19Xh9XRClccrnlUjZX31N/lU:Wvytsymqay0yNn8G37qp8x
MD5:	6CE1EAEE8554EE4B93D7973AE01002D3
SHA1:	2BA243145B73984B404EEBC3257000D9A261FC82
SHA-256:	2811D883B924322B839E4F9B62707EAF0AE017E515387DECBF0190FA00C8EB98
SHA-512:	F26C415601BF338348884AF1480AA4AC2238E5AF2AB906F4CD47D9BE12A61ACEF43640290C1D5AF53B6C1FDDF266BE7224D424F3CC80C6525EE044DDC8734F30
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF854EA4F5FD60E78B.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3191541296723371
Encrypted:	false
SSDEEP:	12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN2cgJ8H1C19CG34Gr9+db3TtT:9vqyVKvqy6yEyvy5DlsN5AcUubjtT
MD5:	849A401645954A0F24E6B85D7207143B
SHA1:	95E73B29C9E4501AACD1F15A569376DEAB641D10
SHA-256:	A07E199627DA9078FEB03BC2CA3D2CC3080D2378FAB67CD3F6DB8BFC8EC17391
SHA-512:	9BD2678BDDD7FA602AB4982B7ABF1800EE1CD2F73BB2FDACC926ECE2BA2C1B1A77EA8A27250A6DA458F869ADFD2C1C72E9C2C1D6E377E9843814425FBE902B41
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\0TCLYWCE.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.416297779335968
Encrypted:	false
SSDEEP:	6:r/h0VPqYl0HEW/8VX6DTiOpNWUTNM06zMXZ0N7+ORBUq:KtdyHEr9SDpNWUTNON3Riq
MD5:	595E8F8A63D249B500638EEF4CDB1133
SHA1:	5C05C055FFA20A042B1A3E7235879AA2991D7F5E
SHA-256:	730B5CF3FDA3DBEDDE842031D6167C2C1EF47CDEDC5FE2962C1895A638DE1CD0
SHA-512:	B3BA34F768299DBC1DBA54AEFCE9A231776F70F54D634FF554B0EEF124ADD59D77AEAFA7B81BA263E5B56F04120B2C51DE7FC19ED7E18FE1B0EF0317002B9CC4
Malicious:	false
Preview:	USRLOC..msn.com/.9729.2694869248.31299837.2938964040.31152986..MUID.0B7EB9A71D6D654F0B8CACC11CC56471.msn.com/.1025.1308046464.31231441.2962831630.31152986.._EDGE_V.1.msn.com/.9728.1268046464.31231441.2932412021.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\1SCOOFXG.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.428136686161808
Encrypted:	false
SSDEEP:	6:r/h0VPqYl0HEW/8r+Op06zMXZ0N7+ORBUq:KtdyHErHmON3Riq
MD5:	150B1CB6CB14C1AE8B22970DE65A3A62
SHA1:	2B43429B708560D9B8ED039438C9C7D1F779AB60
SHA-256:	2DE23CB6BD5CDAE1F1145827A6F7B4F63BFDB3259AD56D1593BC9E0AA2816A03
SHA-512:	50A2661F896EB051E3110D7DD63A9FC7FFF679B0FAABEDB8E5EBEE23BBE755E98635ADE4F002675D9CAFBE258E8965A382438852F8E7FE8D9C299C33A0F5456F
Malicious:	false
Preview:	USRLOC..msn.com/.9729.2694869248.31299837.2938964040.31152986..MUID.0B7EB9A71D6D654F0B8CACC11CC56471.msn.com/.1537.1268046464.31231441.2930852071.31152986.._EDGE_V.1.msn.com/.9728.1268046464.31231441.2932412021.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\3221BAE6.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.379806727117232
Encrypted:	false
SSDEEP:	3:U8Ls2dXv7YnQRsWC/XySFTY61SyhEdWUmnIdXv7YYVBT1YUXdnSySFA:FUWCaSxY61GWMLTiOp3SW
MD5:	57F7E3B61FD9B1A81430C03AB2BABC81
SHA1:	4A097C17D9D7E3D14902416918ADE3D172068573
SHA-256:	FA932A77E8924E9F59B085724E99B0C395907BF297C21D57A235D499D9483166
SHA-512:	0E1E118AA9EC7498D91239A01E458C5380B27E364345179FB0ABEDC83BA52E6FBE2DA0C8084C55B06AD4A752ADA09E30AF4EB76EC0D5389DF4D6444F56D355B3
Malicious:	false
Preview:	MR.0.c.bing.com/.2147484673.3653301376.31154394.2969851417.31152986..SRM_B.0B7EB9A71D6D654F0B8CACC11CC56471.c.bing.com/.2147484673.1308046464.31231441.2969851417.31152986..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\4UYLY2P3.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.409009055021058
Encrypted:	false
SSDEEP:	6:FUWCaSxY61GWMLTiOp3SxY6vWMLTiOp3SW:FUWTU1G9LDp3Uv9LDp3D
MD5:	D2FB989CABA54354FC4136FC58135F5F
SHA1:	5EB3027A85051357B617BF8201B747EF5F5A5629
SHA-256:	E224F387BCC112167D556B4CEC4EA3AAE161488EE70B1DA350C055AA4F29547C
SHA-512:	87FB0CADF3C57C7B2719C63915F953462904FD011EE97015032F888A137EDC5FD4E035295A49606C7201DF7A25C02CC48CC8AF5972258A71C4652DA387A3089E
Malicious:	false
Preview:	MR.0.c.bing.com/.2147484673.3653301376.31154394.2969851417.31152986..SRM_B.0B7EB9A71D6D654F0B8CACC11CC56471.c.bing.com/.2147484673.1308046464.31231441.2969851417.31152986..SRM_M.0B7EB9A71D6D654F0B8CACC11CC56471.c.bing.com/.2147484673.1308046464.31231441.2969851417.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\93KXWL9Q.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	399
Entropy (8bit):	5.074664309109291
Encrypted:	false
SSDEEP:	6:ShQZ3degmRcbadvhm8XBosW0PNSvWrm0N7+O1UF0eCPrXWSD6V8TVP7rvu:ShQpmRgadvzXBoEPNGWN3eSeU9+iTVvu
MD5:	094E014CDA1FCE92AA19185B25E65A62
SHA1:	AE5FC22307D3656687DA8368183895AA31C31A41
SHA-256:	AC59C4440C111EB85BE3B7D50B7D5FAC2EFCCB6EF6A820630268AD0E7756C98D
SHA-512:	FD20905C6A3E4F0720DF478BB478049AF549297C0F528E092FED8FB7885B8A4CAFB19F822478649D92C8521F22EE578D62426435850030697E8688CEC75175A7
Malicious:	false
Preview:	sptmarket.en-us\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=00228959BF934C2FBDC0C5279068997D.RefC=2024-12-31T08:04:57Z.www.msn.com/.1536.2684869248.31299837.2929447974.31152986..MUIDB.0B7EB9A71D6D654F0B8CACC11CC56471.www.msn.com/.9728.1268046464.31231441.2931164397.31152986..MicrosoftApplicationsTelemetryDeviceId.0b5d4e69-0690-4f80-8227-ab43a3f62144.www.msn.com/.1601.678578048.31226412.2954719585.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\9IGHTCQJ.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	521
Entropy (8bit):	5.087892350804673
Encrypted:	false
SSDEEP:	12:ShQpmRgadvzXBoEPNGWN3eSeU9+iTVvL4rmc8cDTVKlCu:jIaadvDUM3exU9jaNiP
MD5:	41567C6FE6ABAC8DD066865764DD7780
SHA1:	6E2FB77F7DE671C64F1C39A1F48537ECB458D045
SHA-256:	B7FBB48FC79F5C320AD2401909232487680524A602220CA4CAB6D8AC7D8E7D71
SHA-512:	E51EEAED5F868CF82D962018648611C9FE2484819B16B2474CCBBF2747AA7DF87CD4F99C8E9FC63904443FD67456C7B82AFC549CF4391AA6827023A548A5EF57
Malicious:	false
Preview:	sptmarket.en-us\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=00228959BF934C2FBDC0C5279068997D.RefC=2024-12-31T08:04:57Z.www.msn.com/.1536.2684869248.31299837.2929447974.31152986..MUIDB.0B7EB9A71D6D654F0B8CACC11CC56471.www.msn.com/.9728.1268046464.31231441.2931164397.31152986..MicrosoftApplicationsTelemetryDeviceId.0b5d4e69-0690-4f80-8227-ab43a3f62144.www.msn.com/.1601.678578048.31226412.2954719585.31152986..ai_session.spnT4fCobSHibLgIfI9dFz\|1735632299762\|1735632299762.www.msn.com/.1601.3767384960.31152990.2954875671.31152986..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\AP1KSH09.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.417051917373551
Encrypted:	false
SSDEEP:	6:r/h0VP6UKVz9NHEW/8r+Op06zMXZ0N7+ORBUq:Kt6BrNHErHmON3Riq
MD5:	F55AD4D60D3D6D90D845427C3726C3F7
SHA1:	6DAEE9FA09BAC5727B50F36BFBDE413F695ABF52
SHA-256:	08262B40797CDC142E57AF0BDC87DD112E34833EEF6287F3DE122BDC70C5976D
SHA-512:	F5547F5ED755C44C918118B0D4D734192EFB3A71B0834E61FDD4DB910FB02104ACD24A03002707939A406E0C4B9C8EFB72BFF8A12792EB7E75E824176D7DDAD0
Malicious:	false
Preview:	USRLOC..msn.com/.9729.2684869248.31299837.2929916026.31152986..MUID.0B7EB9A71D6D654F0B8CACC11CC56471.msn.com/.1537.1268046464.31231441.2930852071.31152986.._EDGE_V.1.msn.com/.9728.1268046464.31231441.2932412021.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\F74PI8IU.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.084161367001086
Encrypted:	false
SSDEEP:	3:U8Ls2dXv7YnQRsWC/XySFA:FUWCaSW
MD5:	9DE503EBF6F3ECE969D932F98378D1BE
SHA1:	7DE6C4D25746470DDB654B16A693585935D61CD2
SHA-256:	59B76C3BC773AC771F1A46E16E1DB356F9260952BA50E4183BB638BD6E1D77B5
SHA-512:	01D6B24D6E8A96841B3D67B19E6C5277AE9A31E002C96F905159BD18E852794EC94263C429085E30A416CB1D0B596FCB6E9D794230FCF4216ABF5795502798E7
Malicious:	false
Preview:	MR.0.c.bing.com/.2147484673.3653301376.31154394.2969851417.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\GCPXIBG7.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.355862368041005
Encrypted:	false
SSDEEP:	3:eThEdWUmnPLJXv7YYVBT1YUXdnSySFA:ZWFLTiOp3SW
MD5:	D37E1AAFADBC08C217AA91F0206E24BC
SHA1:	50E3AED1313D55882E59E52732E05C5A1325335B
SHA-256:	617B1E83B662AD6EF87396A14615DBFBAB62DADD6ED6BFC177E980CC469E59D0
SHA-512:	86242AEA20230DADF6308848DF437BEA59FED1C2F208820BA70DFF922110C69DBEF97A0419AECD23BD0DDDB7DB3DD493EC031E1F9595A1B96E8C2CF005DA483F
Malicious:	false
Preview:	MUID.0B7EB9A71D6D654F0B8CACC11CC56471.bing.com/.2147484673.1308046464.31231441.2969851417.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\GL9X0GBB.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.409446343797962
Encrypted:	false
SSDEEP:	6:9IWMZ8VX6DTiOJFBYe9UfZ8VX6AWC/A/tuvQZ8VX6GNr:+dW9SDTBnSu9jWCA/tuvb955
MD5:	61B29EE64979DA9F7D329955E8C365C8
SHA1:	BB8A38168E459D532AEB42250A9F89ABC8D1E90D
SHA-256:	49B7427A8478AAAF338F018C1A466D2389617DFE7DE4438953F1B77D416C1A79
SHA-512:	FAB6D31153F8EEFAA72E39E742C240E6B013D3D698BEA08FEB4793D6B223A2D162965502E57C9864808C28F9A71710D4891137BC13DD0CB194DD30BAA19DE4B6
Malicious:	false
Preview:	SRM_M.0B7EB9A71D6D654F0B8CACC11CC56471.c.msn.com/.1025.1308046464.31231441.2971567439.31152986..MR.0.c.msn.com/.1025.3653301376.31154394.2971723329.31152986..ANONCHK.0.c.msn.com/.1025.377319552.31152988.2971723329.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\GUNS7VYI.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.924957662534853
Encrypted:	false
SSDEEP:	3:rxAkknQewW+BW+tZBdy+engmRc5edcJa5fvh4rLZfUQ2BRRmtWwdtrRlMWD:ShQZ3degmRcbadvhm8XBosWD
MD5:	2BE8680E863318E4505DC0F6805CFE4D
SHA1:	3AE49F9A50F2E18B9EE394E20B35E3DD4844F819
SHA-256:	4660D11ABB62EC6B4B53FEBAE9168E35E7AEA8BFD531387EEA9C9F49AF322A11
SHA-512:	ED126C35A691EC7E5184BD10445FE080D7B4AFC3CFE1915DCA3F6AD9201EE8004EF92612C8A95CA9038C2A58D4C575E75C6A7566F7BF6FD87F1655F187AE3A26
Malicious:	false
Preview:	sptmarket.en-us\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=00228959BF934C2FBDC0C5279068997D.RefC=2024-12-31T08:04:57Z.www.msn.com/.1536.2684869248.31299837.2929447974.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\I8W1HIP5.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.4271464828825
Encrypted:	false
SSDEEP:	3:9DphEdWUmn0yKfUVX6DT1YUXdmUFweYCw:9IWMZ8VX6DTiOJFBYB
MD5:	C55F3508F510FDB11828A44A933BA764
SHA1:	1F5FE7B06DD68D1B7A8AA5CAAB43F36EABD08C73
SHA-256:	BE3C8CF6E22E27131C26BE914CC25C0D31BDD50A90850FF2892D688272DA1072
SHA-512:	AACD556AC22EBF07B81C38E0B6CED08EBE60E97E99A841D77517EA03AAC2CBDB2FA2913575112638D80A6B776024694DDF70A702D50006E92902B54DF0E60C6F
Malicious:	false
Preview:	SRM_M.0B7EB9A71D6D654F0B8CACC11CC56471.c.msn.com/.1025.1308046464.31231441.2971567439.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\M0BO2707.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	665
Entropy (8bit):	5.136923953910414
Encrypted:	false
SSDEEP:	12:ShQpmRgadvzXBoEPNGWN3eSeU9+iTVvL4rmc8cDTVKlCncnTwwBRXGB1TVDL:jIaadvDUM3exU9jaNilnh8
MD5:	19B1FE0E3C65D8A32AD18986AEAEEB6F
SHA1:	C60497ED23D2698ADBCE7DD536D9F9DBBE1CBAFB
SHA-256:	3F6931589DE74779206246A9A8C350B5E8C6A1F486C6900DE50EA932AE5D3D3F
SHA-512:	AEFCDA9908289637112A585C8613DD86999C75F5304420E1F0AAA37B760B2376AF01E9075786EAD40AEF056A301CDF677F0254F04883BDB961CD021912EE7DC3
Malicious:	false
Preview:	sptmarket.en-us\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=00228959BF934C2FBDC0C5279068997D.RefC=2024-12-31T08:04:57Z.www.msn.com/.1536.2684869248.31299837.2929447974.31152986..MUIDB.0B7EB9A71D6D654F0B8CACC11CC56471.www.msn.com/.9728.1268046464.31231441.2931164397.31152986..MicrosoftApplicationsTelemetryDeviceId.0b5d4e69-0690-4f80-8227-ab43a3f62144.www.msn.com/.1601.678578048.31226412.2954719585.31152986..ai_session.spnT4fCobSHibLgIfI9dFz\|1735632299762\|1735632299762.www.msn.com/.1601.3767384960.31152990.2954875671.31152986..MSFPC.GUID=b8ebc0122d1a446f8de92ba5ff7bed06&HASH=b8eb&LV=202412&V=4&LU=1735632301122.www.msn.com/.1601.688578048.31226412.2963299449.31152986.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\QMHQPZZU.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.4180041603494065
Encrypted:	false
SSDEEP:	3:rEC6KfcSMPT1mtWwdtrcUTVzYQNZhvhhEdWUmnHfUQFIdkUXdiVSoxD:r/h0VP6UKVz9NHEW/8r+Oy
MD5:	96592782CEF1C7C0D16CCF89C1253F38
SHA1:	71DD2B9A790F815EED8873E95F56BD0C47661983
SHA-256:	909A6EAB56B3DF74C35458A599F00211A71E56ADE1210F582024C36EDB096090
SHA-512:	1389491449ADEB912A95722A137A7B2E208CC8B84AF962D863C3483C66A7C599989918ED89626E8965E2ED427B441075649B3AFACD2363B2631737FE65EEF34F
Malicious:	false
Preview:	USRLOC..msn.com/.9729.2684869248.31299837.2929916026.31152986..MUID.0B7EB9A71D6D654F0B8CACC11CC56471.msn.com/.1537.1268046464.31231441.2930852071.31152986..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\QR0SYJ30.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	264
Entropy (8bit):	4.929441741791251
Encrypted:	false
SSDEEP:	6:ShQZ3degmRcbadvhm8XBosW0PNSvWrm0N7+O1UFD:ShQpmRgadvzXBoEPNGWN3eF
MD5:	E17A47DAFF94344F51089CDCCE42EC20
SHA1:	82B6F2888B540D47B8FDC8CC234BEE7E5EFA3CB0
SHA-256:	4DD6180653981C6A324B18D9A6F8B5BEAE52A29F92B478B43C3411BBB7BA9DAC
SHA-512:	9B31B18CB7A6AA20D8B4CFBD6B8A5927089F9BFA5F6825FDF707244FAC5CC77EAF559739B91027A5AF9B0EAA2058ADA523963A9FDFC3456C9BFD0FC51A4D8632
Malicious:	false
Preview:	sptmarket.en-us\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=00228959BF934C2FBDC0C5279068997D.RefC=2024-12-31T08:04:57Z.www.msn.com/.1536.2684869248.31299837.2929447974.31152986..MUIDB.0B7EB9A71D6D654F0B8CACC11CC56471.www.msn.com/.9728.1268046464.31231441.2931164397.31152986..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\TSH09KBJ.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.361372663058182
Encrypted:	false
SSDEEP:	3:9DphEdWUmn0yKfUVX6DT1YUXdmUFweYCdfVvGLfyKfUVX6AWC/wSvCXw:9IWMZ8VX6DTiOJFBYe9UfZ8VX6AWC/b
MD5:	B33F2BD6CE1EEC214FFCC92F0A622FAF
SHA1:	A146215DC76FB04C96A98664ABD599D8BF6CF257
SHA-256:	19F43CE88E9ACFF6E2B97EC65A486B29AB3BAD39061FA4BAB0C78F2A52F40E8F
SHA-512:	0A7BAF24759B37FC3703B7048E0E1B1F8A3D6352F15F165EC2683BF2CEC881224E70E732B3D2055C5BC6F4A30AD38843568C0730A6844DDA375317469600BAB4
Malicious:	false
Preview:	SRM_M.0B7EB9A71D6D654F0B8CACC11CC56471.c.msn.com/.1025.1308046464.31231441.2971567439.31152986..MR.0.c.msn.com/.1025.3653301376.31154394.2971723329.31152986..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\ZTESPJCN.txt

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.077612211296895
Encrypted:	false
SSDEEP:	3:rEC6KfcSMPT1mtWwdtrcUTVzYQA:r/h0VP6UKVz9A
MD5:	3F61BE3835BDB5846137CC4D5F0194C4
SHA1:	9E76ECC2640F097B212139DA038FF9C583C70D37
SHA-256:	517DE6CDAEC79AD597E614512EBB539FD7F027244C10C8CB635FE0B7C2DAF600
SHA-512:	6AE60CB516F87A3B3DF91FBB1290F5A53E206F3CF5BE0E5DDBB02CD58707750D04B9D0F578BF6EF243C6DCC9159D70B860398257D150C41896CA48155F5652F3
Malicious:	false
Preview:	USRLOC..msn.com/.9729.2684869248.31299837.2929916026.31152986.*.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.684687855301
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	25F.tmp.exe
File size:	180'224 bytes
MD5:	348ad3e983cccbab62c3648f0bcb0f88
SHA1:	ba39729ea26b32aee01b4dc57e89f7a909bda3b2
SHA256:	9d8445fe53e5494a49bc714ef07ce39b41ad71ea7de73699f0b28bef16bb9da8
SHA512:	930ac3ee36e432d00915bc7cc0ad6a2b9f05864c5433d9181dfe62b7a0f6717a1439312e0a2257411e74e635358c453f8ebff7958cf7d35f263db3506396acff
SSDEEP:	3072:4TlCjY8xvH/4ssKyw5DlVr6X27aqKnnnnnn1ZcqS+atLFwOSr+I2:4Tlf8CMbvKnnnnnnG+uBq+J
TLSH:	4604D05976D25836F4F524BC7F13854EDD367F205F2C9B8FAA298E4E6C689801B0133A
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	32870e9e8cc61664

Static PE Info

General

Entrypoint:	0x6098f0
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x600000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7da003d8e800bc756c1b5c669773abad

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 006098A8h
call 00007F5EC8E7B80Dh
call 00007F5EC8E7F1D8h
call 00007F5EC8E7A2CFh
mov eax, eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc000	0x67a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10000	0x209a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf000	0xbec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xe018	0x1e	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x890c	0x8a00	bd6a05f4be2120dbcef09f646ae8bc30	False	0.5860224184782609	data	6.429370275870393	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xa000	0x404	0x600	f103e0998158a12d5223843f2763b1da	False	0.3294270833333333	data	2.9582820148833355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xb000	0x7a1	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc000	0x67a	0x800	3dd5e9c053d01f6a245d1c7c049925ec	False	0.3603515625	data	3.9208704439233952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xd000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe000	0x36	0x200	99b7b1893986074cfaeecaf9d49b77f5	False	0.11328125	data	0.7311971302589005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xf000	0xbec	0xc00	129e326df99daca428d64f066aec4c62	False	0.7962239583333334	data	6.532654370403171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x10000	0x20a58	0x20c00	bdd971d47fd507a085ee2df2b7f4b772	False	0.8647274570610687	data	7.928434086651914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x10ab0	0x148	Device independent bitmap graphic, 8 x 16 x 32, image size 288	French	Belgium	0.7682926829268293
RT_STRING	0x10bf8	0x34	data			0.5
RT_STRING	0x10c2c	0xec	data			0.4788135593220339
RT_STRING	0x10d18	0xd0	data			0.5673076923076923
RT_STRING	0x10de8	0x2ac	data			0.4371345029239766
RT_STRING	0x11094	0x358	data			0.4158878504672897
RT_STRING	0x113ec	0x2b4	data			0.4060693641618497
RT_RCDATA	0x116a0	0x3c	data			0.9166666666666666
RT_GROUP_ICON	0x116dc	0x14	data	French	Belgium	1.1
RT_VERSION	0x116f0	0xf80	data			1.0027721774193548
RT_VERSION	0x12670	0xf80	data			1.0027721774193548
RT_VERSION	0x135f0	0xf80	data			1.0027721774193548
RT_VERSION	0x14570	0xf80	OpenPGP Secret Key			1.0027721774193548
RT_VERSION	0x154f0	0xf80	data			1.0027721774193548
RT_VERSION	0x16470	0xf80	data			1.0027721774193548
RT_VERSION	0x173f0	0xf80	data			0.8482862903225806
RT_VERSION	0x18370	0xf80	data			0.3019153225806452
RT_VERSION	0x192f0	0xf80	data			0.6333165322580645
RT_VERSION	0x1a270	0xf80	data			0.3878528225806452
RT_VERSION	0x1b1f0	0xf80	data			1.0027721774193548
RT_VERSION	0x1c170	0xf80	data			1.0027721774193548
RT_VERSION	0x1d0f0	0xf80	data			0.9944556451612904
RT_VERSION	0x1e070	0xf80	data			0.1743951612903226
RT_VERSION	0x1eff0	0xd	ASCII text, with no line terminators			1.6153846153846154
RT_VERSION	0x1f000	0xf80	data			0.5922379032258065
RT_VERSION	0x1ff80	0xf80	data			1.0027721774193548
RT_VERSION	0x20f00	0xf80	data			1.0027721774193548
RT_VERSION	0x21e80	0xf80	data			1.0027721774193548
RT_VERSION	0x22e00	0xf80	data			1.0027721774193548
RT_VERSION	0x23d80	0xf80	data			1.0027721774193548
RT_VERSION	0x24d00	0xf80	data			1.0027721774193548
RT_VERSION	0x25c80	0xf80	data			1.0027721774193548
RT_VERSION	0x26c00	0xf80	data			1.0027721774193548
RT_VERSION	0x27b80	0xf80	data			1.0027721774193548
RT_VERSION	0x28b00	0xf80	data			1.0027721774193548
RT_VERSION	0x29a80	0xf80	data			1.0027721774193548
RT_VERSION	0x2aa00	0xf80	data			1.0027721774193548
RT_VERSION	0x2b980	0xf80	data			1.0027721774193548
RT_VERSION	0x2c900	0xf80	data			1.0027721774193548
RT_VERSION	0x2d880	0xf80	data			1.0027721774193548
RT_VERSION	0x2e800	0xf80	data			1.0027721774193548
RT_VERSION	0x2f780	0xf80	data			1.0027721774193548
RT_VERSION	0x30700	0x1	very short file (no magic)			9.0
RT_VERSION	0x30704	0x4	ASCII text, with no line terminators			3.0
RT_VERSION	0x30708	0x2	ASCII text, with no line terminators			5.0
RT_VERSION	0x3070c	0x1	very short file (no magic)			9.0
RT_VERSION	0x30710	0x1	very short file (no magic)			9.0
RT_VERSION	0x30714	0x294	OpenPGP Secret Key	English	United States	0.4090909090909091

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
kernel32.dll	lstrcmpA, WriteFile, VirtualQuery, LoadLibraryA, GetVersionExA, GetThreadLocale, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetDiskFreeSpaceA, GetCPInfo, GetACP, EnumCalendarInfoA, CloseHandle
user32.dll	CreateWindowExA, MessageBoxA, LoadStringA, GetSystemMetrics, CharNextA, CharToOemA

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	Belgium
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:05:00.240416050 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.240457058 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.240510941 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.240840912 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.240859032 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.240901947 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.240936041 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.240993023 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.241161108 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.241173983 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.270042896 CET	49180	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.270082951 CET	443	49180	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.270148039 CET	49180	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.270513058 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.270529032 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.270576000 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.270772934 CET	49180	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.270788908 CET	443	49180	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.270838022 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.270847082 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.728183031 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.728249073 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.729991913 CET	443	49180	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.730062008 CET	49180	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.735071898 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.735083103 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.735392094 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.735462904 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.739834070 CET	49180	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.739856958 CET	443	49180	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.740287066 CET	443	49180	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.740348101 CET	49180	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.743490934 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.791335106 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838048935 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838114977 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838462114 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838510990 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838519096 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838552952 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838561058 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838571072 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838596106 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838599920 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838612080 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838617086 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838651896 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838879108 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838912010 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838932037 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838937044 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838958979 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838979006 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.838979959 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.838995934 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.839030027 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.839046955 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.839587927 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.839622021 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.839627981 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.839632988 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.839668989 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.842063904 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.843255043 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.843288898 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.843323946 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.843323946 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.843331099 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.843374014 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.853439093 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.853493929 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925287008 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925329924 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925348997 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925374985 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925386906 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925386906 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925410986 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925415993 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925425053 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925425053 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925457001 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925462008 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925467014 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925487995 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925504923 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925509930 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925520897 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925534010 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925559044 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925566912 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925575018 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925620079 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.925631046 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.925668955 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926273108 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926306009 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926312923 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926317930 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926337004 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926346064 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926358938 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926362991 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926372051 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926372051 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926405907 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926409960 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926455975 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926842928 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926877022 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926892996 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926897049 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926914930 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926928043 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926939011 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926943064 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926954031 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926954031 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926986933 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.926986933 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.926995039 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927025080 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927035093 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927079916 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927661896 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927697897 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927715063 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927723885 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927733898 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927736998 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927762032 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927766085 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927776098 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927777052 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927809000 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927809000 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927817106 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927845955 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.927856922 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:00.927938938 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:00.972832918 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.972894907 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.977293015 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.977298975 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.977621078 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.977680922 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.980783939 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.987967968 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.988044977 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.994121075 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:00.994132996 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.994440079 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:00.994664907 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.012758970 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.012767076 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.012797117 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.012840986 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.012847900 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.012875080 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.012885094 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.012914896 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.013453007 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.013488054 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.013504982 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.013509035 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.013531923 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.013546944 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.014197111 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.014251947 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.014259100 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.014302969 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.014398098 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.014409065 CET	443	49181	151.101.2.137	192.168.2.22
Dec 31, 2024 09:05:01.014416933 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.014452934 CET	49181	443	192.168.2.22	151.101.2.137
Dec 31, 2024 09:05:01.027328968 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.239876986 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.239933014 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.239988089 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.241287947 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.241302967 CET	443	49175	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.241357088 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.241357088 CET	49175	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.242681026 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.287332058 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.435092926 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.435234070 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.435324907 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.437709093 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.437726021 CET	443	49174	18.244.18.38	192.168.2.22
Dec 31, 2024 09:05:01.437804937 CET	49174	443	192.168.2.22	18.244.18.38
Dec 31, 2024 09:05:01.437832117 CET	49174	443	192.168.2.22	18.244.18.38

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:04:56.396481037 CET	62751	53	192.168.2.22	8.8.8.8
Dec 31, 2024 09:04:58.321872950 CET	57893	53	192.168.2.22	8.8.8.8
Dec 31, 2024 09:05:00.209182978 CET	65510	53	192.168.2.22	8.8.8.8
Dec 31, 2024 09:05:00.225066900 CET	62672	53	192.168.2.22	8.8.8.8
Dec 31, 2024 09:05:00.239978075 CET	53	62672	8.8.8.8	192.168.2.22
Dec 31, 2024 09:05:00.259526014 CET	49384	53	192.168.2.22	8.8.8.8
Dec 31, 2024 09:05:00.269587040 CET	53	49384	8.8.8.8	192.168.2.22
Dec 31, 2024 09:05:00.382004976 CET	54842	53	192.168.2.22	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 09:04:56.396481037 CET	192.168.2.22	8.8.8.8	0xc2a	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:04:58.321872950 CET	192.168.2.22	8.8.8.8	0x4ab4	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.209182978 CET	192.168.2.22	8.8.8.8	0x397c	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.225066900 CET	192.168.2.22	8.8.8.8	0x7ad0	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.259526014 CET	192.168.2.22	8.8.8.8	0x4bfa	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.382004976 CET	192.168.2.22	8.8.8.8	0x37fb	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 09:04:56.402951002 CET	8.8.8.8	192.168.2.22	0xc2a	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:04:58.336816072 CET	8.8.8.8	192.168.2.22	0x4ab4	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:05:00.218363047 CET	8.8.8.8	192.168.2.22	0x397c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:05:00.239978075 CET	8.8.8.8	192.168.2.22	0x7ad0	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.239978075 CET	8.8.8.8	192.168.2.22	0x7ad0	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.239978075 CET	8.8.8.8	192.168.2.22	0x7ad0	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.239978075 CET	8.8.8.8	192.168.2.22	0x7ad0	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.269587040 CET	8.8.8.8	192.168.2.22	0x4bfa	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.269587040 CET	8.8.8.8	192.168.2.22	0x4bfa	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.269587040 CET	8.8.8.8	192.168.2.22	0x4bfa	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.269587040 CET	8.8.8.8	192.168.2.22	0x4bfa	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:05:00.389281988 CET	8.8.8.8	192.168.2.22	0x37fb	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

code.jquery.com

sb.scorecardresearch.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49181	151.101.2.137	443	3700	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:05:00 UTC	314	OUT	GET /jquery-3.6.3.min.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.msn.com/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: code.jquery.com DNT: 1 Connection: Keep-Alive
2024-12-31 08:05:00 UTC	612	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89947 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15f5b" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1185772 Date: Tue, 31 Dec 2024 08:05:00 GMT X-Served-By: cache-lga21985-LGA, cache-ewr-kewr1740035-EWR X-Cache: HIT, HIT X-Cache-Hits: 587, 0 X-Timer: S1735632301.797684,VS0,VE1 Vary: Accept-Encoding
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 33 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.3 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 45 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 45 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 45 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=E.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return E.each(this,e)},map:function(n){return this.pushStack(E.map(this,f
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 79 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=y.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 76 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 45 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 69 66 28 64 2e 63 73 73 53 75 70 70 6f 72 74 73 53 65 6c 65 63 74 6f 72 26 26 21 43 53 53 2e 73 75 70 70 6f 72 74 73 28 22 73 65 6c 65 63 74 6f Data Ascii: )){(f=ee.test(t)&&ve(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=E)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{if(d.cssSupportsSelector&&!CSS.supports("selecto
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 22 69 6e 20 65 26 26 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 61 29 7b 72 65 74 75 72 6e 20 6c 65 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6f 3d 2b 6f 2c 6c 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 76 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e Data Ascii: "in e&&e.disabled===t}}function ye(a){return le(function(o){return o=+o,le(function(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ve(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 3f 28 62 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 74 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 53 29 7b 76 61 72 20 6e 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 72 65 74 75 72 6e 20 6e 3f 5b 6e 5d 3a 5b 5d 7d 7d 29 3a 28 62 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 Data Ascii: ?(b.filter.ID=function(e){var t=e.replace(te,ne);return function(e){return e.getAttribute("id")===t}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&S){var n=t.getElementById(e);return n?[n]:[]}}):(b.filter.ID=function(e){var n=e.replace
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 52 2b 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 45 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 7e 3d 22 29 2c 28 74 3d 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 22 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 Data Ascii: [selected]").length\|\|y.push("\\["+M+"(?:value\|"+R+")"),e.querySelectorAll("[id~="+E+"-]").length\|\|y.push("~="),(t=C.createElement("input")).setAttribute("name",""),e.appendChild(t),e.querySelectorAll("[name='']").length\|\|y.push("\\["+M+"name"+M+"*="+M+"
2024-12-31 08:05:00 UTC	1378	IN	Data Raw: 6e 74 45 6c 65 6d 65 6e 74 7c 7c 65 2c 72 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 72 29 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 6a 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75 Data Ascii: ntElement\|\|e,r=t&&t.parentNode;return e===r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},j=t?function(e,t){if(e===t)retu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49175	18.244.18.38	443	3700	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:05:00 UTC	515	OUT	GET /b?rn=1735632299605&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=0B7EB9A71D6D654F0B8CACC11CC56471&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Accept: image/png, image/svg+xml, image/;q=0.8, /*;q=0.5 Referer: https://www.msn.com/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sb.scorecardresearch.com DNT: 1 Connection: Keep-Alive
2024-12-31 08:05:01 UTC	657	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 31 Dec 2024 08:05:01 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1735632299605&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=0B7EB9A71D6D654F0B8CACC11CC56471&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=14E06ac0e6e71ba2b029fc21735632301; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 e4f83d72be7853fbcceb590827a5b68a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: r1MqcoqDGf7o-bo6DaEPtAWJcjVjodwdnLLNiZoW1MW1-stF0UKLEw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49174	18.244.18.38	443	3700	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:05:01 UTC	516	OUT	GET /b2?rn=1735632299605&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=0B7EB9A71D6D654F0B8CACC11CC56471&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Accept: image/png, image/svg+xml, image/;q=0.8, /*;q=0.5 Referer: https://www.msn.com/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sb.scorecardresearch.com DNT: 1 Connection: Keep-Alive
2024-12-31 08:05:01 UTC	327	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 31 Dec 2024 08:05:01 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 abf6c055b398b223d7325958955066c0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: hRT2YiJJ7khZBqyu1pxPMRUgxZqddWBxpUKrxiD8dsarhUveBPLbCw==

Target ID:	0
Start time:	03:04:33
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\25F.tmp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\25F.tmp.exe"
Imagebase:	0x600000
File size:	180'224 bytes
MD5 hash:	348AD3E983CCCBAB62C3648F0BCB0F88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:04:43
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\25F.tmp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\25F.tmp.exe
Imagebase:	0x600000
File size:	180'224 bytes
MD5 hash:	348AD3E983CCCBAB62C3648F0BCB0F88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:04:44
Start date:	31/12/2024
Path:	C:\Windows\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\notepad.exe"
Imagebase:	0xff820000
File size:	193'536 bytes
MD5 hash:	B32189BDFF6E577A92BAA61AD49264E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:04:44
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\25F.tmp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\25F.tmp.exe
Imagebase:	0x600000
File size:	180'224 bytes
MD5 hash:	348AD3E983CCCBAB62C3648F0BCB0F88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:04:47
Start date:	31/12/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
Imagebase:	0x880000
File size:	815'304 bytes
MD5 hash:	8A590F790A98F3D77399BE457E01386A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:04:47
Start date:	31/12/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
Imagebase:	0x13f530000
File size:	814'288 bytes
MD5 hash:	4EB098135821348270F27157F7A84E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:04:50
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0xa70000
File size:	355'328 bytes
MD5 hash:	54B7C43C2E89F5CE71B2C255C1CF35E2
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:04:50
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:04:50
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:04:50
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	03:04:50
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:04:51
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:04:51
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	03:04:51
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:04:51
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	03:04:51
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	03:04:51
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	03:04:52
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	03:04:52
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:04:52
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	03:04:52
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	03:04:53
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	03:04:53
Start date:	31/12/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:275457 /prefetch:2
Imagebase:	0x880000
File size:	815'304 bytes
MD5 hash:	8A590F790A98F3D77399BE457E01386A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	03:04:54
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	03:04:54
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	03:04:54
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:04:54
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	03:04:54
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	03:04:55
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	03:04:55
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	03:04:55
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	03:04:55
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	03:04:55
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	03:04:55
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	03:04:55
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	03:04:56
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	03:04:56
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	03:04:56
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	03:04:56
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	03:04:56
Start date:	31/12/2024
Path:	C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lCyiQRNfhEzGlaSPpHBrxoqlJRwrIjunLvVcUmoVIwpyPGeLpZxDbxi\QgGhoOpxHPl.exe"
Imagebase:	0x1230000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.6%
Total number of Nodes:	1339
Total number of Limit Nodes:	20

Executed Functions

Function 00609014 Relevance: 47.6, APIs: 12, Strings: 15, Instructions: 328
injectionlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000), ref: 00609061
LoadLibraryA.KERNEL32(00000000), ref: 00609089

Part of subcall function 00608D40: lstrcmp.KERNEL32(?,?), ref: 00608D95

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 006092D4
ReadProcessMemory.KERNELBASE(?,?,00000005,00000004,00000000), ref: 0060931D

Part of subcall function 00604F9C: CreateWindowExA.USER32 ref: 00604FD9

NtUnmapViewOfSection.NTDLL(?,00000005,00000000,?,00000000,00000000,000000FA,00000182,80000000,80000000), ref: 0060935F
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000004), ref: 0060937D
WriteProcessMemory.KERNELBASE(?,00000000,00609905,?,00000000), ref: 0060939A
WriteProcessMemory.KERNELBASE(?,?,00609905,?,?,?,00609905), ref: 00609411
VirtualProtectEx.KERNELBASE(?,?,?,00000040,?,?,00609905), ref: 00609431
WriteProcessMemory.KERNELBASE(?,?,00000000,00000004,00000000), ref: 00609453
Wow64SetThreadContext.KERNEL32(?,00010007), ref: 00609472
ResumeThread.KERNELBASE(?), ref: 0060947C

Strings

QfbgSql`fppNfnlqz, xrefs: 006090F3
first Window app, xrefs: 00609340
@qfbwfSql`fppB, xrefs: 0060909B
oloooool, xrefs: 00609345
UjqwvboSqlwf`wF{, xrefs: 006091A2
Hfqmfo01, xrefs: 0060904B
TqjwfSql`fppNfnlqz, xrefs: 0060914B
MWGOO, xrefs: 00609073
PfwWkqfbg@lmwf{w, xrefs: 00609176
PE, xrefs: 00609263
D, xrefs: 00609297
DfwWkqfbg@lmwf{w, xrefs: 006090C7
QfpvnfWkqfbg, xrefs: 006091CE
UjqwvboBool`F{, xrefs: 0060911F
MZ, xrefs: 0060923E

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: Process$Memory$Write$CreateLibraryLoadThreadVirtual$AllocContextProtectReadResumeSectionUnmapViewWindowWow64lstrcmp
String ID: @qfbwfSql`fppB$D$DfwWkqfbg@lmwf{w$Hfqmfo01$MWGOO$MZ$PE$PfwWkqfbg@lmwf{w$QfbgSql`fppNfnlqz$QfpvnfWkqfbg$TqjwfSql`fppNfnlqz$UjqwvboBool`F{$UjqwvboSqlwf`wF{$first Window app$oloooool
API String ID: 2528929211-2128899875
Opcode ID: d87c723a2cb561c1242fafc6be16d314feaded0c2aac151016e52f6c516e272c
Instruction ID: 715b9aa7201df64e9751e330e1e9c19a6bf475734f272f1f24890eb41cefc1f1
Opcode Fuzzy Hash: d87c723a2cb561c1242fafc6be16d314feaded0c2aac151016e52f6c516e272c
Instruction Fuzzy Hash: 2BC10B71A402189FDB54EBA8CC85BDFB7BAEF48300F5040A9F649E72C1DA749E458F64

Function 006047B8 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000000), ref: 006047D3
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 006047F1
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 0060480F
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0060482D
RegQueryValueExA.ADVAPI32 ref: 00604876
RegQueryValueExA.ADVAPI32 ref: 00604894
RegCloseKey.ADVAPI32(?), ref: 006048B6
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 006048D3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 006048E0
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 006048E6
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00604911
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00604966
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00604976
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 006049A2
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 006049B2
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 006049DC
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?), ref: 006049EC

Strings

Software\Borland\Locales, xrefs: 006047E7, 00604805
Software\Borland\Delphi\Locales, xrefs: 00604823

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 3f75bca011fb74f87a44d5ef03a66c42f68c1ef6d93babe70a88f60babc03960
Instruction ID: 439e08d33a6fac8019160a22a772f9821e7e571ee344117f973a4ccba17bbda3
Opcode Fuzzy Hash: 3f75bca011fb74f87a44d5ef03a66c42f68c1ef6d93babe70a88f60babc03960
Instruction Fuzzy Hash: B26186B1E8424D7EEB29DAE4CC46FEFB7BD9B09300F4040A5B744E61C1DAB4DA458B54

Function 006048C3 Relevance: 15.1, APIs: 10, Instructions: 101
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 006048D3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 006048E0
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 006048E6
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00604911
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00604966
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00604976
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 006049A2
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 006049B2
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 006049DC
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?), ref: 006049EC

Strings

Software\Borland\Locales, xrefs: 006047E7, 00604805
Software\Borland\Delphi\Locales, xrefs: 00604823

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 4588dc4074c2392e32c2cdd69237c61b79bff1c8d06a6c5efebbf484b27bfb5e
Instruction ID: 2ea8edce084a28266abf1f81c2071a4b319a879fe6d4c62b47c76c420ca39287
Opcode Fuzzy Hash: 4588dc4074c2392e32c2cdd69237c61b79bff1c8d06a6c5efebbf484b27bfb5e
Instruction Fuzzy Hash: E13197B1E8424D7EDB69DAE8CC85FDFB7BE9B19300F0041A5A244E61C1DBB89E458B50

Function 00608DD8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 42
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000), ref: 00608E0A

Part of subcall function 00608D40: lstrcmp.KERNEL32(?,?), ref: 00608D95

OutputDebugStringA.KERNELBASE(that made me looool,00000000,00608E58,?,?,?,00000000,00000000,?,00608839,00000000,006089C8,?,?,?,00000005), ref: 00608E3B

Strings

that made me looool, xrefs: 00608E36
LvwsvwGfavdPwqjmdB, xrefs: 00608E19
Hfqmfo01, xrefs: 00608DF7

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: DebugLibraryLoadOutputStringlstrcmp
String ID: Hfqmfo01$LvwsvwGfavdPwqjmdB$that made me looool
API String ID: 1902896288-1512227557
Opcode ID: ac9e2763bc583bae6a6ae1e0cdd70218bde24cb25572d77f1616a3f6bdbf989c
Instruction ID: 91cfcea0a7c87a67f9c2548e482a2e6c48ff6f34df040ee4925186b5e68baebf
Opcode Fuzzy Hash: ac9e2763bc583bae6a6ae1e0cdd70218bde24cb25572d77f1616a3f6bdbf989c
Instruction Fuzzy Hash: BEF081307807146FE348EBA4CC12B5F7AAEDB85740F510478F580977C2DE749E008668

Function 006019D0 Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 006019E7
RtlEnterCriticalSection.KERNEL32(0060B5C4,0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 006019FA
LocalAlloc.KERNEL32(00000000,00000FF8,0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 00601A24
RtlLeaveCriticalSection.KERNEL32(0060B5C4,00601A9F,00000000,00601A98,?,?,?,006023F6), ref: 00601A92

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: d83a478d0fbd83e8168573bd93e1b4583d2a59f1f9abd21cdc0df2ac30b95189
Instruction ID: 74df882c1a01e5d4aec3e25528a86efcb18e16bd6ea950092898227c461be41d
Opcode Fuzzy Hash: d83a478d0fbd83e8168573bd93e1b4583d2a59f1f9abd21cdc0df2ac30b95189
Instruction Fuzzy Hash: 671160B0AC4241AFD75DEF99CC15B5BBBE3DB4A300F14E4A9A1009B3D1C7754D418B58

Function 00604F9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32 ref: 00604FD9

Strings

first Window app, xrefs: 00604FD5
oloooool, xrefs: 00604FD6

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: CreateWindow
String ID: first Window app$oloooool
API String ID: 716092398-2688301056
Opcode ID: bf0f031763fedf2387eb07865909b2dcda5b1958d1a37e0667197b562cbda9e5
Instruction ID: 6bf7e3dfdf983de485033f2134917db6cee18bc32def7ed793967fc69823b713
Opcode Fuzzy Hash: bf0f031763fedf2387eb07865909b2dcda5b1958d1a37e0667197b562cbda9e5
Instruction Fuzzy Hash: C2F0AFB2704259BFDB94DE9DDC85E9B77ECEB8C2A0B004129BA0CD7241D630ED108BB4

Function 0060222C Relevance: 3.1, APIs: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006019D0: RtlInitializeCriticalSection.KERNEL32(0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 006019E7
Part of subcall function 006019D0: RtlEnterCriticalSection.KERNEL32(0060B5C4,0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 006019FA
Part of subcall function 006019D0: LocalAlloc.KERNEL32(00000000,00000FF8,0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 00601A24
Part of subcall function 006019D0: RtlLeaveCriticalSection.KERNEL32(0060B5C4,00601A9F,00000000,00601A98,?,?,?,006023F6), ref: 00601A92

RtlEnterCriticalSection.KERNEL32(0060B5C4,00000000,006023C8), ref: 00602275
RtlLeaveCriticalSection.KERNEL32(0060B5C4,006023CF), ref: 006023C2

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID:
API String ID: 2227675388-0
Opcode ID: 181fc5323324d463e0b204c274c5e8fb49fba454a3ba2a41092107ee5311f17d
Instruction ID: 5009b1ea9114b0094a56e97b8433b4d1c1f2aca413a5a65d1e4d938f1911b195
Opcode Fuzzy Hash: 181fc5323324d463e0b204c274c5e8fb49fba454a3ba2a41092107ee5311f17d
Instruction Fuzzy Hash: 03516CB0A80206DFCB09CFA8D995A6FB7F2FF58310F28A5A9D404A7391D3349A41CF55

Function 006038F4 Relevance: 3.1, APIs: 2, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000,00000000,006028C8,?,00603A82,00608D1B,00000000), ref: 0060397F
ExitProcess.KERNEL32(00000000,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000,00000000,006028C8,?,00603A82,00608D1B,00000000), ref: 006039B7

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: b19a67943c7b2b1daf05f16b5513985e7e93d5d216d3c41cae7a9180b9467bc7
Instruction ID: 55b83ea6f2e826010a0c4ece7eb1e404212ef759f0753011510d9abf1eba2f5f
Opcode Fuzzy Hash: b19a67943c7b2b1daf05f16b5513985e7e93d5d216d3c41cae7a9180b9467bc7
Instruction Fuzzy Hash: 2C21A1708802649FDB29AF24C4887AB7BDBAF04316F15555CE985873C2E7B48E80CB56

Function 006038EC Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000,00000000,006028C8,?,00603A82,00608D1B,00000000), ref: 0060397F
ExitProcess.KERNEL32(00000000,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000,00000000,006028C8,?,00603A82,00608D1B,00000000), ref: 006039B7

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: f325069adf687070a334fa40697b9fcd49a212d5335c7f3a9d341d9d974e8e5f
Instruction ID: 2f9eaafb93ec8653e51b4cd82b3db4cc76f12950b731b8b38f5c632ff51ff3d3
Opcode Fuzzy Hash: f325069adf687070a334fa40697b9fcd49a212d5335c7f3a9d341d9d974e8e5f
Instruction Fuzzy Hash: 2221D6708803A49FDB39AF2484887977BEBAF05316F15555CE585473C2E3B48DC0CB56

Function 006038F0 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000,00000000,006028C8,?,00603A82,00608D1B,00000000), ref: 0060397F
ExitProcess.KERNEL32(00000000,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000,00000000,006028C8,?,00603A82,00608D1B,00000000), ref: 006039B7

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 341c4753de2e16dcf88b5fb5b33cd53f2a95c020f09f9771af9a8d17ec18d375
Instruction ID: 64ed28c09305657a82541d19f37544494afd81c1243ae3d87e68d10d64a254a8
Opcode Fuzzy Hash: 341c4753de2e16dcf88b5fb5b33cd53f2a95c020f09f9771af9a8d17ec18d375
Instruction Fuzzy Hash: 702180708803649FDB39AF6484887AB7BEBAF04316F15555CE985873C2E7B48EC0CB56

Function 00601430 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,006017C3), ref: 0060145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,006017C3), ref: 00601486

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 62c46e49b18d3defb6c247ac89b686f8f7fdff1e2458d18e37cbeebf33e7946b
Instruction ID: 57ffc85c0a8273567a7168f065d21b94aa5c1f4b0fa45c5bbeece7ce0f1900f1
Opcode Fuzzy Hash: 62c46e49b18d3defb6c247ac89b686f8f7fdff1e2458d18e37cbeebf33e7946b
Instruction Fuzzy Hash: 01F02772B802201BEB6869694C81BA75AC78F87790F1540B5FA08EF3C9D2A18C0443A4

Function 00604B70 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32 ref: 00604BA2

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 711959ec69ddf0aef349c976c532a5887a28d6375e42e04a3a5292524e5b3d5f
Instruction ID: 575e67a8becf17fef0a47515d8a560dacb20805ddcb8754f24ae3875a67bce89
Opcode Fuzzy Hash: 711959ec69ddf0aef349c976c532a5887a28d6375e42e04a3a5292524e5b3d5f
Instruction Fuzzy Hash: E9F0A0B57401209FCB69EA5CCCC1B8733CE9B48351B0480A4BA48CB39ADFA0CD4487E6

Function 00604524 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00604542

Part of subcall function 006047B8: GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000000), ref: 006047D3
Part of subcall function 006047B8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 006047F1
Part of subcall function 006047B8: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 0060480F
Part of subcall function 006047B8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0060482D
Part of subcall function 006047B8: RegQueryValueExA.ADVAPI32 ref: 00604876
Part of subcall function 006047B8: RegQueryValueExA.ADVAPI32 ref: 00604894
Part of subcall function 006047B8: RegCloseKey.ADVAPI32(?), ref: 006048B6

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 7431fb8d9b58ce30a09f7010ff69392a576d677b875bf995706f5953506670f3
Instruction ID: 3694939effd4bc20e2227c6228316c499c5c40963d8b001cc774436d54ef47f8
Opcode Fuzzy Hash: 7431fb8d9b58ce30a09f7010ff69392a576d677b875bf995706f5953506670f3
Instruction Fuzzy Hash: 22E06DB2A402148FCB64DE5C88C1A9733D9AB08750F000555EE68CF38BD7B1DD5087D5

Function 0060150C Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(0000000C,00000000,00008000), ref: 00601585

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2cc36d4e18f8689b60fce1552236b6984c8fff9fcceb3222b8138fffddcafd23
Instruction ID: 8075652f9aa784974d24d701d5858d32910630675db23c5cae8cd0a8faf102c4
Opcode Fuzzy Hash: 2cc36d4e18f8689b60fce1552236b6984c8fff9fcceb3222b8138fffddcafd23
Instruction Fuzzy Hash: 2521CFB46443069FC315DF18D884A5ABBE2FB89360F64896DF5D9CB390E331E880CB56

Function 00601694 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 00601724

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 380f0e667cdcda35798dd9e0ee4925b4df56ff15883d885e4c50dcfe8142ae0c
Instruction ID: 4a16f731b22991ac2a76659ab9516555874ef3e08bfb9b4dc2af4afb2578c23d
Opcode Fuzzy Hash: 380f0e667cdcda35798dd9e0ee4925b4df56ff15883d885e4c50dcfe8142ae0c
Instruction Fuzzy Hash: AE21F0B4244302CFC754CF2CD880A5ABBE1FF9A354F2449A9E594CB394E331E909CB52

Function 00608D40 Relevance: 1.3, APIs: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,?), ref: 00608D95

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: lstrcmp
String ID:
API String ID: 1534048567-0
Opcode ID: 6935ef7d523316265f7f0a10a8c9e10d1c8778d49998078bf7c2a287e26e37eb
Instruction ID: 3c3163c8fd1f24db34742e99c5fb436953fbcfcfa9b1c5a11e8948193b302a98
Opcode Fuzzy Hash: 6935ef7d523316265f7f0a10a8c9e10d1c8778d49998078bf7c2a287e26e37eb
Instruction Fuzzy Hash: 3F1146B17047019FC364DF1EC881A17B7E6EFD8224B09CA79E498C3762E630E8158B44

Non-executed Functions

Function 006045E0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0060593C,?,00000000), ref: 006045FD
GetProcAddress.KERNEL32(00000000,GetLongPathNameA,kernel32.dll,0060593C,?,00000000), ref: 0060460E
lstrcpyn.KERNEL32(?,?,?,?,00000000), ref: 00604642
lstrcpyn.KERNEL32(?,?,?,kernel32.dll,0060593C,?,00000000), ref: 006046B3
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 006046EE
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 00604701
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 0060470E
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 0060471A
lstrcpyn.KERNEL32(?,?,00000104,?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C), ref: 0060474E
lstrlen.KERNEL32(?,?,?,00000104,?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C), ref: 0060475A
lstrcpyn.KERNEL32(?,?,?,?,?,?,00000104,?,00000000,?,?,?,?,?,?,?), ref: 00604783

Strings

kernel32.dll, xrefs: 006045F8
GetLongPathNameA, xrefs: 00604608
\, xrefs: 0060472C

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 2e4b354c8dbaeedcc6917afc53ded3b95313a27eaa8e3af3d783511b16afa5e1
Instruction ID: f25b1826d3d404d435323bdc63ce11a4a697c9fd044df481343fbc9de6b959a4
Opcode Fuzzy Hash: 2e4b354c8dbaeedcc6917afc53ded3b95313a27eaa8e3af3d783511b16afa5e1
Instruction Fuzzy Hash: 77513CB1D80158AFCB25DBE8CC85AEFB7FEAF46300F050595E255E7281DB709E408BA4

Function 00604C91 Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00602ED4: GetKeyboardType.USER32 ref: 00602ED9
Part of subcall function 00602ED4: GetKeyboardType.USER32 ref: 00602EE5

GetCommandLineA.KERNEL32 ref: 00604CF7
GetVersion.KERNEL32 ref: 00604D0B
GetVersion.KERNEL32 ref: 00604D1C
GetCurrentThreadId.KERNEL32 ref: 00604D58

Part of subcall function 00602F04: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00602F26
Part of subcall function 00602F04: RegQueryValueExA.ADVAPI32 ref: 00602F59
Part of subcall function 00602F04: RegCloseKey.ADVAPI32(?), ref: 00602F6F

GetThreadLocale.KERNEL32 ref: 00604D38

Part of subcall function 00604BC8: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00604C2E), ref: 00604BEE

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 5427cc31308d50f8f58cb81c4086aa616b8e4a906fae4bce7af71f1dfe7d5ce2
Instruction ID: feb53608f4c1b4819b7fdf81e77006572a780a3a92dd732f2b90cdc25788172e
Opcode Fuzzy Hash: 5427cc31308d50f8f58cb81c4086aa616b8e4a906fae4bce7af71f1dfe7d5ce2
Instruction Fuzzy Hash: 600125F44C4341C5E76DBF60AC8674B3A639F13344F14B85DE2514A3E2EF754184976A

Function 00607C80 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00607CE4), ref: 00607CA6
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,00607CE4), ref: 00607CBF

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e880894ba020ddc62ee596d8cd5c09b1b6c01c9434385aacb196ec82a547e250
Instruction ID: e89210931a58a638a6c846f21b12b636f4f6c60df288084de7a95f4b792750e4
Opcode Fuzzy Hash: e880894ba020ddc62ee596d8cd5c09b1b6c01c9434385aacb196ec82a547e250
Instruction Fuzzy Hash: 37F09671E483086FEB19EFA1C85299FB3AFE7C8714F50C469F210D66C1EA7466008A54

Function 00605F28 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32 ref: 00605F5C

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 304410d0ac547e5d1d925de7d2a7376f39ccb66023ae0efdc727b0736b15850a
Instruction ID: 56b83d0a114dc4be76b8d184bf3d54b45b608cab0625a8ac54ddf8ee86293d10
Opcode Fuzzy Hash: 304410d0ac547e5d1d925de7d2a7376f39ccb66023ae0efdc727b0736b15850a
Instruction Fuzzy Hash: A31103B1E45549AFCB04CF99C9819EFBBF9EF4D300B54816AE509E7251D6319A018F90

Function 00604BC8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00604C2E), ref: 00604BEE

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 70c7e4fc98cf2963b94dc73ecb73314ef86e2f22dd4bc1e3663de0f25d4ac65e
Instruction ID: de02df595dd3802e8db4d01f9782a19aad22c1cb7f6af6c436d93557c2efe90b
Opcode Fuzzy Hash: 70c7e4fc98cf2963b94dc73ecb73314ef86e2f22dd4bc1e3663de0f25d4ac65e
Instruction Fuzzy Hash: 5FF0A470A44359AFEB18DF91CC42AEFB37BFB85710F408838A210A76C0EAB42A448754

Function 00606ADC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00606AFA

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ecbe04fde73bee193d0a7b72de749cc9874a89fd528d86f59dc676076a77a520
Instruction ID: 528e98083a0427f583ee3b78d34b5c1355cdf3de2a17f51a606cd5cd7331dfb5
Opcode Fuzzy Hash: ecbe04fde73bee193d0a7b72de749cc9874a89fd528d86f59dc676076a77a520
Instruction Fuzzy Hash: EAE0D8B274021427D328A9588C829F7B25DD798350F40416EBE45C73C2EEB0DEA043E8

Function 00606B28 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00607F96,00000000,006081AF,?,?,00000000,00000000), ref: 00606B3B

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5cec4e5afaeaf7eaca505266971298c5afb2efbe419083297d0db2ffeb56b179
Instruction ID: 2538a127b28bf230c487c05fe2e7f249dc592227c9c39867c770b0dc62bb897f
Opcode Fuzzy Hash: 5cec4e5afaeaf7eaca505266971298c5afb2efbe419083297d0db2ffeb56b179
Instruction Fuzzy Hash: 52D05EA634D2503AE228515B6D85DBB9B9DCAC67A0F10403EF648C6242D2408C169371

Function 00608A50 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6decf1d1d02f52841c9f77c5de55f8057d9970dd0da59bebd052367ecff51cd
Instruction ID: 8e12e25e056cb71a3afc59d0f44886ba09b1843c74ae03e0eb158fe747ed93a1
Opcode Fuzzy Hash: b6decf1d1d02f52841c9f77c5de55f8057d9970dd0da59bebd052367ecff51cd
Instruction Fuzzy Hash: C6C01232525608EFD701DB8CD542D8A73FCE704550F100056E004C7611D275BE00C695

Function 00608A6C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cfc8dc4a528fbbf25044f93a9797f47fa72584d321842d4ebb925aa7f3c2e1e
Instruction ID: 06c4e8a793d4ab25ad989b9b0a09be4f73708adb57caf7c1e801a34a23d219df
Opcode Fuzzy Hash: 1cfc8dc4a528fbbf25044f93a9797f47fa72584d321842d4ebb925aa7f3c2e1e
Instruction Fuzzy Hash: BAC08C3652A208EFD704CB8CE542DCAB3FCEB08620F100097F408C3700E2B5BF008A90

Function 00608A40 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c674b6cdca997e85205c1468a1f0b6fd4ed41847160108e45f4ec15252cf568
Instruction ID: 6c2cb4c646a9b00e64ea07d0a50451ec9922eed192b56962ea4157afcc4061d9
Opcode Fuzzy Hash: 9c674b6cdca997e85205c1468a1f0b6fd4ed41847160108e45f4ec15252cf568
Instruction Fuzzy Hash: CFB012381818C44ECA168704401179177626781710FC53080C0C147A02461849029400

Function 00607EE4 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,006081AF,?,?,00000000,00000000), ref: 00607F1A

Part of subcall function 00606ADC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00606AFA

Strings

:mm:ss, xrefs: 0060816A
:mm, xrefs: 0060814D
AMPM , xrefs: 0060813D
AMPM, xrefs: 0060812E
mmmm d, yyyy, xrefs: 00608016
m/d/yy, xrefs: 00607FE9

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 405970b93d369cb88c6105069f13510f53fd476ac40e868c890e2f5029489c8f
Instruction ID: f84dacb58a5ec69ebe353e46d4ea67f2db6b91476feb507f417b75987f752d9b
Opcode Fuzzy Hash: 405970b93d369cb88c6105069f13510f53fd476ac40e868c890e2f5029489c8f
Instruction Fuzzy Hash: A46160307802499FDB48FBA4DC4169F7BABDF89300F50A478B542AB3C6CA35DE168718

Function 00609624 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 122libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000), ref: 00609674

Strings

Hfqmfo01, xrefs: 00609661
OlbgQfplvq`f, xrefs: 006096A8
EjmgQfplvq`fB, xrefs: 00609683
EqffQfplvq`f, xrefs: 00609719
PjyfleQfplvq`f, xrefs: 006096CD
Ol`hQfplvq`f, xrefs: 006096F3

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: LibraryLoad
String ID: EjmgQfplvq`fB$EqffQfplvq`f$Hfqmfo01$Ol`hQfplvq`f$OlbgQfplvq`f$PjyfleQfplvq`f
API String ID: 1029625771-1297955608
Opcode ID: 50a1be8785d472289030787bf25c4f1d7d0ebf42d9f267e51da72cc4393963f9
Instruction ID: 39f62e41613c841c82e5d73a37b016aa8bff7db7b0af8e5ffb24b86a5f561013
Opcode Fuzzy Hash: 50a1be8785d472289030787bf25c4f1d7d0ebf42d9f267e51da72cc4393963f9
Instruction Fuzzy Hash: CB41ED31B902185FDB88EBA4C851ADFB6BEEF48340F504439F541A73C2EA749E018BA4

Function 00603868 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00603932,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000), ref: 006038A1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?), ref: 006038A7
GetStdHandle.KERNEL32(000000F5,006038F0,00000002,?,00000000,00000000,?,00603932,?,?,?,?,00000002,006039DE,0060292B,00602973), ref: 006038BC
WriteFile.KERNEL32(00000000,000000F5,006038F0,00000002,?), ref: 006038C2
MessageBoxA.USER32 ref: 006038E0

Strings

Error, xrefs: 006038D4
Runtime error at 00000000, xrefs: 0060389A, 006038D9

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0de637ff2df70bf3d24f60879d7482bd274cc52ed5bac0e5d9a1a20b0b58f315
Instruction ID: 2124d88e66a0689c667f87b3bfccbc2f9e17d8888c3032dd70b9ee23f7f0035c
Opcode Fuzzy Hash: 0de637ff2df70bf3d24f60879d7482bd274cc52ed5bac0e5d9a1a20b0b58f315
Instruction Fuzzy Hash: 22F0B470AC439878E7386BA09D0BFAF234F9741F19F14E659B3519C2D1DBA44AC49226

Function 00607048 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00607064
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00607088
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 006070A3
LoadStringA.USER32 ref: 00607147

Strings

8S`, xrefs: 006070EF
P`, xrefs: 00607133

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: 8S`$P`
API String ID: 3990497365-1792595465
Opcode ID: 89b3f9bb937295af7cd429966be731153e1d714cef756d376cb3c10833ea981d
Instruction ID: c8a1f16859b4dcf090157e96d894a6f6421ab70c159423d212d38e17420c788a
Opcode Fuzzy Hash: 89b3f9bb937295af7cd429966be731153e1d714cef756d376cb3c10833ea981d
Instruction Fuzzy Hash: E6410CB0A4425C9FDB69DB58CC85BDFB7BAAB44300F0440E9A608E7291D774AF848F55

Function 00607046 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00607064
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00607088
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 006070A3
LoadStringA.USER32 ref: 00607147

Strings

8S`, xrefs: 006070EF
P`, xrefs: 00607133

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: 8S`$P`
API String ID: 3990497365-1792595465
Opcode ID: f9160e2e3aea943f337618f753a94f9a5b8617bef0c3aad1d4f9833616218498
Instruction ID: 65422663e8b175293843514dc2e6730b18d16fd9701fe0644df9e792c6c37fbb
Opcode Fuzzy Hash: f9160e2e3aea943f337618f753a94f9a5b8617bef0c3aad1d4f9833616218498
Instruction Fuzzy Hash: 9D412E70A8425C9FDB69DB58CC85BDFB7FAAB04300F0440E9A608E7291D774AF848F55

Function 006071E0 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00607048: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00607064
Part of subcall function 00607048: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00607088
Part of subcall function 00607048: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 006070A3
Part of subcall function 00607048: LoadStringA.USER32 ref: 00607147

CharToOemA.USER32 ref: 00607217
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 00607234
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?), ref: 0060723A
GetStdHandle.KERNEL32(000000F4,006072A4,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0060724F
WriteFile.KERNEL32(00000000,000000F4,006072A4,00000002,?), ref: 00607255
LoadStringA.USER32 ref: 00607277
MessageBoxA.USER32 ref: 0060728D

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 6972115aa8794e35d0410798ef050c4773f5b9befd8970058d6dddba8381a8a3
Instruction ID: eb9fee9d3dd4f480ad86a08fe3e3c715f1e52eb9def34b6db25ae0c784218af9
Opcode Fuzzy Hash: 6972115aa8794e35d0410798ef050c4773f5b9befd8970058d6dddba8381a8a3
Instruction Fuzzy Hash: 0B114CB15883466ED358F7A4CC46F9B77EEAB84300F404519B354D60E2DF74E9048B2A

Function 00601AA8 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0060B5C4,00000000,00601B9C), ref: 00601AD7
LocalFree.KERNEL32(?,00000000,00601B9C), ref: 00601AE9
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00601B9C), ref: 00601B0D
LocalFree.KERNEL32(00000000,?,00000000,00008000,?,00000000,00601B9C), ref: 00601B5E
RtlLeaveCriticalSection.KERNEL32(0060B5C4,00601BA3,?,00000000,00601B9C), ref: 00601B8C
RtlDeleteCriticalSection.KERNEL32(0060B5C4,00601BA3,?,00000000,00601B9C), ref: 00601B96

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 8690fb42c9bd25ff62939df394a92059a33dc87e72416101bb119c48be79a6f8
Instruction ID: c74aeac536d04daf1d9aaa2b88ae39994b19cafb1f7c4f4c32481e89d1555f1e
Opcode Fuzzy Hash: 8690fb42c9bd25ff62939df394a92059a33dc87e72416101bb119c48be79a6f8
Instruction Fuzzy Hash: 51213B74AC4244AFD75EEFA8DC56B5BBBE6EB0A300F10A499F5009B3E1D7345940DB14

Function 00602F04 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00602F26
RegQueryValueExA.ADVAPI32 ref: 00602F59
RegCloseKey.ADVAPI32(?), ref: 00602F6F

Strings

FPUMaskValue, xrefs: 00602F50
SOFTWARE\Borland\Delphi\RTL, xrefs: 00602F1C

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 1157a01e19796f37f2b5cc992d638ddb1fe2541e9874435bd59190aab0a157df
Instruction ID: c03fda469428753ecf02ecefcce68b4b7182e76c56f88a0b924b5aea7086ba02
Opcode Fuzzy Hash: 1157a01e19796f37f2b5cc992d638ddb1fe2541e9874435bd59190aab0a157df
Instruction Fuzzy Hash: 3601B5755C030AB9DB15DBE0CC56BFB77BDDB09744F5000A5BA04D65C0E6705A14D798

Function 00606D64 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00606DFB,?,?,00000000), ref: 00606D7C

Part of subcall function 00606ADC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00606AFA

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00606DFB,?,?,00000000), ref: 00606DAC
EnumCalendarInfoA.KERNEL32(Function_00006CB0,00000000,00000000,00000004), ref: 00606DB7
GetThreadLocale.KERNEL32(00000000,00000003,00000000,00606DFB,?,?,00000000), ref: 00606DD5
EnumCalendarInfoA.KERNEL32(Function_00006CEC,00000000,00000000,00000003), ref: 00606DE0

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 64468f9e38e86cbae6d5be39c18cfd5a5062b6d04b52a85de6321f918ccf37d8
Instruction ID: 351a49cc6eeb8d263ff2a59df9ed8983b84ceb925ca044530df0050181d320a2
Opcode Fuzzy Hash: 64468f9e38e86cbae6d5be39c18cfd5a5062b6d04b52a85de6321f918ccf37d8
Instruction Fuzzy Hash: 940126757C42486BE319FBB0CC13B5B765FEF85720F510564F600E66C2EA659E1082A9

Function 00606E14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00606FDE,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00606E43

Part of subcall function 00606ADC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00606AFA

Strings

ggg, xrefs: 00606F28
eeee, xrefs: 00606F4E
yyyy, xrefs: 00606F35

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: b291cb8597261f6514058d5d14fcbabcc4e1ef7db54b89a8c03662ca38e12f5f
Instruction ID: 549bb3956218e062135398211ae85f01a1fb8ae2f528c7acbdc3c2fb8c59784f
Opcode Fuzzy Hash: b291cb8597261f6514058d5d14fcbabcc4e1ef7db54b89a8c03662ca38e12f5f
Instruction Fuzzy Hash: 254103357C82164BD71DAB78C8816BFF7ABDB84300B604569F442D33C6DA70EE16C669

Function 00606B8C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00606C9F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00606BA8

Strings

DR`, xrefs: 00606C35
Q`, xrefs: 00606BE9
|R`, xrefs: 00606C5A

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: LocaleThread
String ID: DR`$|R`$Q`
API String ID: 635194068-1853681101
Opcode ID: 06f649347e903f645061d77f2fb1060dac145866f74880fa77775b5ebe0026ea
Instruction ID: 239d570031dca18a3b836607bbb55e997dcfd0203a85c96b2fac2a33e89f6fe5
Opcode Fuzzy Hash: 06f649347e903f645061d77f2fb1060dac145866f74880fa77775b5ebe0026ea
Instruction Fuzzy Hash: B131B471F801085BD708DA95C891BAF77AFDB88310F11447AFA09D73C1DA35ED1187A9

Function 00608288 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00608799,00000000,006087AC), ref: 0060828E
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA,kernel32.dll,?,00608799,00000000,006087AC), ref: 0060829F

Strings

GetDiskFreeSpaceExA, xrefs: 00608299
kernel32.dll, xrefs: 00608289

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 3d83e3763f9cb26a47f97c377c5ba6a369e8466b53bdeef0079a243f54f614f4
Instruction ID: 5e6b4c9483f2f7c51195c5a922daefa23dd3e15a114a57c8b2c2df2eadd9ead3
Opcode Fuzzy Hash: 3d83e3763f9cb26a47f97c377c5ba6a369e8466b53bdeef0079a243f54f614f4
Instruction Fuzzy Hash: 41D09EB06C1F469EF718EBE15C85613359F9740349F40A429B143472D1EEA589445FE5

Function 00607D6C Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(?,00000002,?,00000080,?), ref: 00607E66
GetThreadLocale.KERNEL32 ref: 00607D96

Part of subcall function 00607CF4: GetCPInfo.KERNEL32(00000000,?), ref: 00607D0D

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: c20fea7ece837fd4a4d4c232880b2c9fb4836bd1c3298877a86fcb63a872c9ac
Instruction ID: 031fbc90ea44a9d57a695ee475c96b9f8855e0aa644ccf8bf3c3245cd95ddff9
Opcode Fuzzy Hash: c20fea7ece837fd4a4d4c232880b2c9fb4836bd1c3298877a86fcb63a872c9ac
Instruction Fuzzy Hash: 84312621EC93858BD764DB64EC017A73FA7EB91305F04A0D9E9448B3D2EB346C49C766

Function 006076BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0060787F), ref: 00607729
GetModuleFileNameA.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0060787F), ref: 0060774B

Part of subcall function 00604B70: LoadStringA.USER32 ref: 00604BA2

Strings

|Q`, xrefs: 006077D1

Memory Dump Source

Source File: 00000000.00000002.369325894.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.369323264.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369328633.000000000060C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.369333444.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_25F.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: |Q`
API String ID: 902310565-1287144811
Opcode ID: f04f175d259c25fdcbc041710ef7f9a517576aab3b3a3207c45b177d1155a1ec
Instruction ID: 29300fce4ad5f21c6a0c8294c9238be0950d320ce33057e9c1de983e8ff0d5f7
Opcode Fuzzy Hash: f04f175d259c25fdcbc041710ef7f9a517576aab3b3a3207c45b177d1155a1ec
Instruction Fuzzy Hash: CE51D270A44658DFDB65DB68CD85BCAB7FAAB48300F4041E9E508AB391E770AE84CF51

Analysis Process: 25F.tmp.exePID: 3356, Parent PID: 3252COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.3%
Total number of Nodes:	1682
Total number of Limit Nodes:	12

Executed Functions

Function 00401170 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 165
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowCaret.USER32(00000000), ref: 0040118E
NtUnmapViewOfSection.NTDLL(774B0000,0B813440,00000164,00400000,?,00000000), ref: 004011B3
ShowCaret.USER32(00000000), ref: 004011B7
VirtualAllocEx.KERNELBASE(756E0000,0030B70C,00000164,00400000,0004E000,00003000,00000040,?,00000000), ref: 004011EC
ShowCaret.USER32(00000000), ref: 004011F0
WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,00400000,?,00000400,00000000,?,00000000), ref: 0040121B
ShowCaret.USER32(00000000), ref: 0040121F
ShowCaret.USER32(00000000), ref: 00401239
ShowCaret.USER32(00000000), ref: 0040125E
WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,0004C000,00015A00,00001E00,00000000,?,00000000), ref: 00401299
ShowCaret.USER32(00000000), ref: 004012CA
ShowCaret.USER32(00000000), ref: 004012EE
WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,7EFDDFF8,00407114,00000004,00000000,?,00000000), ref: 00401320
ShowCaret.USER32(00000000), ref: 00401324
ShowCaret.USER32(00000000), ref: 0040133B
Wow64SetThreadContext.KERNEL32(756E0000,00BA2230,00000168,00406620,?,00000000), ref: 0040135B
ShowCaret.USER32(00000000), ref: 0040135F
ResumeThread.KERNELBASE(756E0000,000BCC14,00000168,?,00000000), ref: 0040137A

Strings

`p@, xrefs: 0040117C, 00401240
Hq@, xrefs: 00401189, 00401190, 004011C5, 004011F2, 00401221, 00401271, 004012A0, 004012F0, 00401326

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: CaretShow$MemoryProcessWrite$Thread$AllocContextResumeSectionUnmapViewVirtualWow64
String ID: Hq@$`p@
API String ID: 480950890-1281468770
Opcode ID: b6b0f8813bb7eff36c5e92e955d4611ca0407a266504072ab683b035350681cc
Instruction ID: 1cedc51185f688dccbac480823edada26e59cc5e99e7b06dbe20370140511c73
Opcode Fuzzy Hash: b6b0f8813bb7eff36c5e92e955d4611ca0407a266504072ab683b035350681cc
Instruction Fuzzy Hash: 2D510DF5610610AFD344EB59EE91F2637F9FB88704F028169F506E73A5C6B4B821CB68

Function 00401600 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 138
processlibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004015C0: GetCurrentProcess.KERNEL32(00000000,?,0040160D,?,00000000), ref: 004015D7

SHGetFolderPathW.SHELL32(00000000,-0000002A,00000000,00000000,?), ref: 00401635
lstrcatW.KERNEL32(?,\notepad.exe,?,00000000), ref: 00401645
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0040165D

Part of subcall function 00401530: ShowCaret.USER32(00000000), ref: 0040154C

ShowCaret.USER32(00000000), ref: 0040169B
ShowCaret.USER32(00000000), ref: 0040169F
ShowCaret.USER32(00000000), ref: 004016C7
ShowCaret.USER32(00000000), ref: 004016E8
LoadLibraryA.KERNEL32(advapi32.dll), ref: 004016F4
EnumResourceNamesA.KERNEL32(756E0000,02CAC166,00000000,00000015,00401040,00000000,?,00000000), ref: 00401721

Part of subcall function 00401390: ShowCaret.USER32(00000000), ref: 00401396
Part of subcall function 00401390: VirtualProtect.KERNELBASE(756E0000,0030C13C,00000000), ref: 00401433

ShowCaret.USER32(00000000), ref: 0040173B
CreateProcessW.KERNEL32(756E0000,002BAF82,?,00000000,?,00000000), ref: 00401782
ShowCaret.USER32(00000000), ref: 0040179A

Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 0040118E
Part of subcall function 00401170: NtUnmapViewOfSection.NTDLL(774B0000,0B813440,00000164,00400000,?,00000000), ref: 004011B3
Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 004011B7
Part of subcall function 00401170: VirtualAllocEx.KERNELBASE(756E0000,0030B70C,00000164,00400000,0004E000,00003000,00000040,?,00000000), ref: 004011EC
Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 004011F0
Part of subcall function 00401170: WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,00400000,?,00000400,00000000,?,00000000), ref: 0040121B
Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 0040121F
Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 00401239
Part of subcall function 00401170: ShowCaret.USER32(00000000), ref: 0040125E
Part of subcall function 00401170: WriteProcessMemory.KERNELBASE(756E0000,03140762,00000164,0004C000,00015A00,00001E00,00000000,?,00000000), ref: 00401299

Strings

open, xrefs: 00401656
advapi32.dll, xrefs: 004016EF
OPIOOUKHJJTY, xrefs: 0040178B
\notepad.exe, xrefs: 0040163F

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: CaretShow$Process$MemoryVirtualWrite$AllocCreateCurrentEnumExecuteFolderLibraryLoadNamesPathProtectResourceSectionShellUnmapViewlstrcat
String ID: OPIOOUKHJJTY$\notepad.exe$advapi32.dll$open
API String ID: 1655093362-2236918752
Opcode ID: 1b204ab233147d46d13166e20a68fa83a0cf2c5b14558259fd0cdf6a8d0390c1
Instruction ID: 21d5881589ab2f9bb9e7312981c207e25e63c3dc4e9fed1a4688bf212c1fbff5
Opcode Fuzzy Hash: 1b204ab233147d46d13166e20a68fa83a0cf2c5b14558259fd0cdf6a8d0390c1
Instruction Fuzzy Hash: FC418AB1690300BFE210E760DD42F6B37E9E7C4B44F118539B605FB1E1D9B8A914876D

Function 00401390 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowCaret.USER32(00000000), ref: 00401396
VirtualProtect.KERNELBASE(756E0000,0030C13C,00000000), ref: 00401433

Strings

910, xrefs: 004013AE
V/, xrefs: 004013D7

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: CaretProtectShowVirtual
String ID: 910$V/
API String ID: 3929742858-341175346
Opcode ID: baf9333768f30c66eaba00d9cb631bdcffc0c17c59462f0b4dfa1dc181a1cdd6
Instruction ID: 7adf0c5093f46c572695bcb1cc4dacb91342d891db2e85d7d2a02cab4f7e0da6
Opcode Fuzzy Hash: baf9333768f30c66eaba00d9cb631bdcffc0c17c59462f0b4dfa1dc181a1cdd6
Instruction Fuzzy Hash: 841151B5201210AFD250EBA5DD85F2777FCEB88754F124229FA0AE32A1C674BD108779

Function 004037EF Relevance: 5.1, APIs: 4, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapReAlloc.KERNEL32(00000000,00000060,00000000,00000000,004035B7,00000000,?,?,?,00401836), ref: 00403817
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,004035B7,00000000,?,?,?,00401836), ref: 0040384B
VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004,?,00401836), ref: 00403865
HeapFree.KERNEL32(00000000,?), ref: 0040387C

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: f01af24e2874631ea2779b74758652f445791352bac989eab95b762f4ea42c63
Instruction ID: 6faec744670907b242940572656bc554ab04cd7dd9b01d2055736a1d5a4cc04c
Opcode Fuzzy Hash: f01af24e2874631ea2779b74758652f445791352bac989eab95b762f4ea42c63
Instruction Fuzzy Hash: AF116D712006209FD7209F18ED449267BF9FB44365711893AF152EA5F0D371A9A6CF48

Function 00401966 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00401951,?,00000000,00000000,004018AF,00000000,00000000), ref: 0040197B
TerminateProcess.KERNEL32(00000000,?,00401951,?,00000000,00000000,004018AF,00000000,00000000), ref: 00401982
ExitProcess.KERNEL32 ref: 00401A03

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 71278d1f4220bcb8620912db61f9dc75cd8a913f590e7f49d4acebac21ec4584
Instruction ID: 6cdff9f0591df1e3503e952f8288832a1c9edc8ebce298b207857a9186d4ea9a
Opcode Fuzzy Hash: 71278d1f4220bcb8620912db61f9dc75cd8a913f590e7f49d4acebac21ec4584
Instruction Fuzzy Hash: BA01C0B12412019EDA109B69FE99A1EBBA4EB80350B11403FF4827B1F0CB399850DE6D

Function 004022C9 Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00401824,00000001), ref: 004022DA

Part of subcall function 00403152: HeapAlloc.KERNEL32(00000000,00000140,004022EE), ref: 0040315F

HeapDestroy.KERNEL32 ref: 004022F8

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 60b094575c43ce829687a51dfa7d6f82ea7a4c2e4d015bc827a296030f121e6a
Instruction ID: 40c72eb45e5c1eccc1a22d81960c52d894ac1ab4987cbc5cee3b80ace42f3743
Opcode Fuzzy Hash: 60b094575c43ce829687a51dfa7d6f82ea7a4c2e4d015bc827a296030f121e6a
Instruction Fuzzy Hash: 57E01275610300AAFF101B31EF49B6B3AD5EB44782F058436B805E81E0E7B489D0A958

Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EndTask.USER32 ref: 00401006

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: Task
String ID:
API String ID: 4065096731-0
Opcode ID: 14f1c2be7496dc62ca041e2660ef3e8e0519321bab3e56e9faf973b6ea3495f4
Instruction ID: 333b99c93a70b1c55f9c9043c7c8b5c49931c667e1abf1932cd73e56e3ef5478
Opcode Fuzzy Hash: 14f1c2be7496dc62ca041e2660ef3e8e0519321bab3e56e9faf973b6ea3495f4
Instruction Fuzzy Hash: 88D0A73C1483C159DA118E108811BA27B515F93B4CF2880DEE5C42F7E3C1365C47D725

Function 004030C5 Relevance: 1.3, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(00000008,?,?,?,?,0040221A,00000001,00000074,?,00401836), ref: 0040311A

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: be1dcb0f2ca5d9915bb146dd65e79aac8d54812c6b123a79e5cb88223f99ff47
Instruction ID: 63a47281f7fccb9a522bad3f45b21b828df9063caa348d8c451a67992f3c2ab6
Opcode Fuzzy Hash: be1dcb0f2ca5d9915bb146dd65e79aac8d54812c6b123a79e5cb88223f99ff47
Instruction Fuzzy Hash: 73019C33A0161027E9212E255D41B5F3A1D9B84BB7F1A0237FC507B3C2D67D8E0141DD

Non-executed Functions

Function 006047B8 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000000), ref: 006047D3
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 006047F1
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 0060480F
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0060482D
RegQueryValueExA.ADVAPI32 ref: 00604876
RegQueryValueExA.ADVAPI32 ref: 00604894
RegCloseKey.ADVAPI32(?), ref: 006048B6
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 006048D3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 006048E0
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 006048E6
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00604911
lstrcpynA.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00604966
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00604976
lstrcpynA.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 006049A2
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 006049B2
lstrcpynA.KERNEL32(?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 006049DC
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?), ref: 006049EC

Strings

Software\Borland\Locales, xrefs: 006047E7, 00604805
Software\Borland\Delphi\Locales, xrefs: 00604823

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 021115018b862506af814cf2b311653b5a214d6eec4a7b788135a882baf68f3d
Instruction ID: 439e08d33a6fac8019160a22a772f9821e7e571ee344117f973a4ccba17bbda3
Opcode Fuzzy Hash: 021115018b862506af814cf2b311653b5a214d6eec4a7b788135a882baf68f3d
Instruction Fuzzy Hash: B26186B1E8424D7EEB29DAE4CC46FEFB7BD9B09300F4040A5B744E61C1DAB4DA458B54

Function 006045E0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
stringlibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0060593C,?,00000000), ref: 006045FD
GetProcAddress.KERNEL32(00000000,GetLongPathNameA,kernel32.dll,0060593C,?,00000000), ref: 0060460E
lstrcpynA.KERNEL32(?,?,?,?,00000000), ref: 00604642
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,0060593C,?,00000000), ref: 006046B3
lstrcpynA.KERNEL32(?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 006046EE
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 00604701
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 0060470E
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C,?,00000000), ref: 0060471A
lstrcpynA.KERNEL32(?,?,00000104,?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C), ref: 0060474E
lstrlenA.KERNEL32(?,?,?,00000104,?,00000000,?,?,?,?,?,?,?,?,kernel32.dll,0060593C), ref: 0060475A
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,00000000,?,?,?,?,?,?,?), ref: 00604783

Strings

kernel32.dll, xrefs: 006045F8
\, xrefs: 0060472C
GetLongPathNameA, xrefs: 00604608

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 2e4b354c8dbaeedcc6917afc53ded3b95313a27eaa8e3af3d783511b16afa5e1
Instruction ID: f25b1826d3d404d435323bdc63ce11a4a697c9fd044df481343fbc9de6b959a4
Opcode Fuzzy Hash: 2e4b354c8dbaeedcc6917afc53ded3b95313a27eaa8e3af3d783511b16afa5e1
Instruction Fuzzy Hash: 77513CB1D80158AFCB25DBE8CC85AEFB7FEAF46300F050595E255E7281DB709E408BA4

Function 006048C3 Relevance: 15.1, APIs: 10, Instructions: 101
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 006048D3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 006048E0
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 006048E6
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00604911
lstrcpynA.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00604966
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00604976
lstrcpynA.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 006049A2
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 006049B2
lstrcpynA.KERNEL32(?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 006049DC
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?), ref: 006049EC

Strings

Software\Borland\Locales, xrefs: 006047E7, 00604805
Software\Borland\Delphi\Locales, xrefs: 00604823

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: fbee07662e67e25edda719bac5f00b0db6dba760934fe37d0afadedae1740f6a
Instruction ID: 2ea8edce084a28266abf1f81c2071a4b319a879fe6d4c62b47c76c420ca39287
Opcode Fuzzy Hash: fbee07662e67e25edda719bac5f00b0db6dba760934fe37d0afadedae1740f6a
Instruction Fuzzy Hash: E13197B1E8424D7EDB69DAE8CC85FDFB7BE9B19300F0041A5A244E61C1DBB89E458B50

Function 0040399B Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll), ref: 004039AD
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004039C5
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 004039D6
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 004039E3

Strings

user32.dll, xrefs: 004039A8
GetLastActivePopup, xrefs: 004039D8
GetActiveWindow, xrefs: 004039D0
MessageBoxA, xrefs: 004039BF

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 56fcd12e22422f3926956bab43dc5e187367ba90ba411f881e403aaca0228d71
Instruction ID: a479ffe80b3d4e596aad1b70f613aa0b77e146be3452bb55d1156979b56034e0
Opcode Fuzzy Hash: 56fcd12e22422f3926956bab43dc5e187367ba90ba411f881e403aaca0228d71
Instruction Fuzzy Hash: E20175317003029BC710EFF56D80D1B7EECD649792315443FA542F22A1D6B8C811AF6D

Function 00609014 Relevance: 30.1, APIs: 2, Strings: 15, Instructions: 328
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000), ref: 00609061
LoadLibraryA.KERNEL32(00000000), ref: 00609089

Part of subcall function 00608D40: lstrcmpA.KERNEL32(?,?), ref: 00608D95

Part of subcall function 00604F9C: CreateWindowExA.USER32 ref: 00604FD9

Strings

PfwWkqfbg@lmwf{w, xrefs: 00609176
TqjwfSql`fppNfnlqz, xrefs: 0060914B
UjqwvboSqlwf`wF{, xrefs: 006091A2
UjqwvboBool`F{, xrefs: 0060911F
Hfqmfo01, xrefs: 0060904B
oloooool, xrefs: 00609345
D, xrefs: 00609297
MZ, xrefs: 0060923E
DfwWkqfbg@lmwf{w, xrefs: 006090C7
QfbgSql`fppNfnlqz, xrefs: 006090F3
@qfbwfSql`fppB, xrefs: 0060909B
PE, xrefs: 00609263
first Window app, xrefs: 00609340
MWGOO, xrefs: 00609073
QfpvnfWkqfbg, xrefs: 006091CE

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: LibraryLoad$CreateWindowlstrcmp
String ID: @qfbwfSql`fppB$D$DfwWkqfbg@lmwf{w$Hfqmfo01$MWGOO$MZ$PE$PfwWkqfbg@lmwf{w$QfbgSql`fppNfnlqz$QfpvnfWkqfbg$TqjwfSql`fppNfnlqz$UjqwvboBool`F{$UjqwvboSqlwf`wF{$first Window app$oloooool
API String ID: 2125446073-2128899875
Opcode ID: d87c723a2cb561c1242fafc6be16d314feaded0c2aac151016e52f6c516e272c
Instruction ID: 715b9aa7201df64e9751e330e1e9c19a6bf475734f272f1f24890eb41cefc1f1
Opcode Fuzzy Hash: d87c723a2cb561c1242fafc6be16d314feaded0c2aac151016e52f6c516e272c
Instruction Fuzzy Hash: 2BC10B71A402189FDB54EBA8CC85BDFB7BAEF48300F5040A9F649E72C1DA749E458F64

Function 00403B2E Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00405414,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403B70
LCMapStringA.KERNEL32(00000000,00000100,00405410,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403B8C
LCMapStringA.KERNEL32(?,00000100,00000020,00000001,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403BD5
MultiByteToWideChar.KERNEL32(00000000,00000101,00000020,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00403C0D
MultiByteToWideChar.KERNEL32(00000000,00000001,00000020,00000001,00000100,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403C65
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403C7B
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403CAE
LCMapStringW.KERNEL32(?,00000100,00000100,00000100,?,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00403D16

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 9b1fb0eaeae7abdf1945f3128f7ae684e41b35706a3eb2943a3cdfd2cbdd8426
Instruction ID: 1c21f9441693a9a0395c5586c8818974786ee025f7665dbb4546bf95d124890a
Opcode Fuzzy Hash: 9b1fb0eaeae7abdf1945f3128f7ae684e41b35706a3eb2943a3cdfd2cbdd8426
Instruction Fuzzy Hash: 8D519C72900209ABDF219F94CD45ADF7FB8FB88755F10412AF910B12A0C3399E61DBA9

Function 00607EE4 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,006081AF,?,?,00000000,00000000), ref: 00607F1A

Part of subcall function 00606ADC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00606AFA

Strings

AMPM , xrefs: 0060813D
mmmm d, yyyy, xrefs: 00608016
AMPM, xrefs: 0060812E
m/d/yy, xrefs: 00607FE9
:mm, xrefs: 0060814D
:mm:ss, xrefs: 0060816A

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 405970b93d369cb88c6105069f13510f53fd476ac40e868c890e2f5029489c8f
Instruction ID: f84dacb58a5ec69ebe353e46d4ea67f2db6b91476feb507f417b75987f752d9b
Opcode Fuzzy Hash: 405970b93d369cb88c6105069f13510f53fd476ac40e868c890e2f5029489c8f
Instruction Fuzzy Hash: A46160307802499FDB48FBA4DC4169F7BABDF89300F50A478B542AB3C6CA35DE168718

Function 00609624 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 122libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000), ref: 00609674

Strings

Ol`hQfplvq`f, xrefs: 006096F3
PjyfleQfplvq`f, xrefs: 006096CD
OlbgQfplvq`f, xrefs: 006096A8
EqffQfplvq`f, xrefs: 00609719
EjmgQfplvq`fB, xrefs: 00609683
Hfqmfo01, xrefs: 00609661

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: LibraryLoad
String ID: EjmgQfplvq`fB$EqffQfplvq`f$Hfqmfo01$Ol`hQfplvq`f$OlbgQfplvq`f$PjyfleQfplvq`f
API String ID: 1029625771-1297955608
Opcode ID: 50a1be8785d472289030787bf25c4f1d7d0ebf42d9f267e51da72cc4393963f9
Instruction ID: 39f62e41613c841c82e5d73a37b016aa8bff7db7b0af8e5ffb24b86a5f561013
Opcode Fuzzy Hash: 50a1be8785d472289030787bf25c4f1d7d0ebf42d9f267e51da72cc4393963f9
Instruction Fuzzy Hash: CB41ED31B902185FDB88EBA4C851ADFB6BEEF48340F504439F541A73C2EA749E018BA4

Function 00402511 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0040257E
GetStdHandle.KERNEL32(000000F4,00405348,00000000,?,00000000,?), ref: 00402654
WriteFile.KERNEL32(00000000), ref: 0040265B

Strings

<program name unknown>, xrefs: 0040258E
..., xrefs: 004025D0
Runtime Error!Program: , xrefs: 004025E4
Microsoft Visual C++ Runtime Library, xrefs: 0040262A

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 0c2281f3aa94957885efe1dd98b9d45b276729d5152b46fa3ea8c28481f0212a
Instruction ID: dc953bc63a9f778bc1b12ee88897f7fe90698b9d6db9149e529bfef901ecca1e
Opcode Fuzzy Hash: 0c2281f3aa94957885efe1dd98b9d45b276729d5152b46fa3ea8c28481f0212a
Instruction Fuzzy Hash: DB3185726002186EDF20EA60CE49F9B776CEF45304F50047BF945F61C1D6B8AA948E59

Function 00603868 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00603932,?,?,?,?,00000002,006039DE,0060292B,00602973,00000000), ref: 006038A1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?), ref: 006038A7
GetStdHandle.KERNEL32(000000F5,006038F0,00000002,?,00000000,00000000,?,00603932,?,?,?,?,00000002,006039DE,0060292B,00602973), ref: 006038BC
WriteFile.KERNEL32(00000000,000000F5,006038F0,00000002,?), ref: 006038C2
MessageBoxA.USER32 ref: 006038E0

Strings

Error, xrefs: 006038D4
Runtime error at 00000000, xrefs: 0060389A, 006038D9

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0de637ff2df70bf3d24f60879d7482bd274cc52ed5bac0e5d9a1a20b0b58f315
Instruction ID: 2124d88e66a0689c667f87b3bfccbc2f9e17d8888c3032dd70b9ee23f7f0035c
Opcode Fuzzy Hash: 0de637ff2df70bf3d24f60879d7482bd274cc52ed5bac0e5d9a1a20b0b58f315
Instruction Fuzzy Hash: 22F0B470AC439878E7386BA09D0BFAF234F9741F19F14E659B3519C2D1DBA44AC49226

Function 00401F0D Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401F28
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401F3C
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401F68
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0040185C), ref: 00401FA0
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0040185C), ref: 00401FC2
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,0040185C), ref: 00401FDB
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0040185C), ref: 00401FEE
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040202C

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 6cc6b04491aafc98d39791db8cca144a75cc353a196cdcde92c063c0bf283cdb
Instruction ID: 3866f0483314f29f1618ff4dfa568d2e56ff3937cd63a0f44ec9b139913bb891
Opcode Fuzzy Hash: 6cc6b04491aafc98d39791db8cca144a75cc353a196cdcde92c063c0bf283cdb
Instruction Fuzzy Hash: 2931E5B25043126FE7203F755DC883F769CE645358B11053BFA42F32D0EAB94C4186AD

Function 00607048 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00607064
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00607088
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 006070A3
LoadStringA.USER32 ref: 00607147

Strings

8S`, xrefs: 006070EF
P`, xrefs: 00607133

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: 8S`$P`
API String ID: 3990497365-1792595465
Opcode ID: 89b3f9bb937295af7cd429966be731153e1d714cef756d376cb3c10833ea981d
Instruction ID: c8a1f16859b4dcf090157e96d894a6f6421ab70c159423d212d38e17420c788a
Opcode Fuzzy Hash: 89b3f9bb937295af7cd429966be731153e1d714cef756d376cb3c10833ea981d
Instruction Fuzzy Hash: E6410CB0A4425C9FDB69DB58CC85BDFB7BAAB44300F0440E9A608E7291D774AF848F55

Function 00607046 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00607064
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00607088
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 006070A3
LoadStringA.USER32 ref: 00607147

Strings

8S`, xrefs: 006070EF
P`, xrefs: 00607133

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: 8S`$P`
API String ID: 3990497365-1792595465
Opcode ID: f9160e2e3aea943f337618f753a94f9a5b8617bef0c3aad1d4f9833616218498
Instruction ID: 65422663e8b175293843514dc2e6730b18d16fd9701fe0644df9e792c6c37fbb
Opcode Fuzzy Hash: f9160e2e3aea943f337618f753a94f9a5b8617bef0c3aad1d4f9833616218498
Instruction Fuzzy Hash: 9D412E70A8425C9FDB69DB58CC85BDFB7FAAB04300F0440E9A608E7291D774AF848F55

Function 006071E0 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00607048: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00607064
Part of subcall function 00607048: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00607088
Part of subcall function 00607048: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 006070A3
Part of subcall function 00607048: LoadStringA.USER32 ref: 00607147

CharToOemA.USER32 ref: 00607217
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 00607234
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?), ref: 0060723A
GetStdHandle.KERNEL32(000000F4,006072A4,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0060724F
WriteFile.KERNEL32(00000000,000000F4,006072A4,00000002,?), ref: 00607255
LoadStringA.USER32 ref: 00607277
MessageBoxA.USER32 ref: 0060728D

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 6972115aa8794e35d0410798ef050c4773f5b9befd8970058d6dddba8381a8a3
Instruction ID: eb9fee9d3dd4f480ad86a08fe3e3c715f1e52eb9def34b6db25ae0c784218af9
Opcode Fuzzy Hash: 6972115aa8794e35d0410798ef050c4773f5b9befd8970058d6dddba8381a8a3
Instruction Fuzzy Hash: 0B114CB15883466ED358F7A4CC46F9B77EEAB84300F404519B354D60E2DF74E9048B2A

Function 00403D7D Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00405414,00000001,00000000,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403DBC
GetStringTypeA.KERNEL32(00000000,00000001,00405410,00000001,00000000,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403DD6
GetStringTypeA.KERNEL32(00000000,?,00000100,00000020,00000001,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403E0A
MultiByteToWideChar.KERNEL32(00402A37,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,00402A37,00000001,00000020,00000100,?,00000000), ref: 00403E42
MultiByteToWideChar.KERNEL32(00402A37,00000001,00000100,00000020,?,00000100,?,00000100,00000000,00402A37,00000001,00000020,00000100,?), ref: 00403E98
GetStringTypeW.KERNEL32(?,?,00000000,00000001,?,00000100,?,00000100,00000000,00402A37,00000001,00000020,00000100,?), ref: 00403EAA

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 07bb9862341e01356d0dff1c427b7db7969236951c1baf01262c24fa338bcbd1
Instruction ID: 0f8efcfe3fc3890c713297aeb0959f0275bfe311c219aa286c24befefaedaadf
Opcode Fuzzy Hash: 07bb9862341e01356d0dff1c427b7db7969236951c1baf01262c24fa338bcbd1
Instruction Fuzzy Hash: 6C417B71A00219AFCF219F94DD85AEF7FB9EB08711F104536FA01E6290C3399E508BE9

Function 00601AA8 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0060B5C4,00000000,00601B9C), ref: 00601AD7
LocalFree.KERNEL32(?,00000000,00601B9C), ref: 00601AE9
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00601B9C), ref: 00601B0D
LocalFree.KERNEL32(00000000,?,00000000,00008000,?,00000000,00601B9C), ref: 00601B5E
LeaveCriticalSection.KERNEL32(0060B5C4,00601BA3,?,00000000,00601B9C), ref: 00601B8C
DeleteCriticalSection.KERNEL32(0060B5C4,00601BA3,?,00000000,00601B9C), ref: 00601B96

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 8690fb42c9bd25ff62939df394a92059a33dc87e72416101bb119c48be79a6f8
Instruction ID: c74aeac536d04daf1d9aaa2b88ae39994b19cafb1f7c4f4c32481e89d1555f1e
Opcode Fuzzy Hash: 8690fb42c9bd25ff62939df394a92059a33dc87e72416101bb119c48be79a6f8
Instruction Fuzzy Hash: 51213B74AC4244AFD75EEFA8DC56B5BBBE6EB0A300F10A499F5009B3E1D7345940DB14

Function 00604C91 Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00602ED4: GetKeyboardType.USER32 ref: 00602ED9
Part of subcall function 00602ED4: GetKeyboardType.USER32 ref: 00602EE5

GetCommandLineA.KERNEL32 ref: 00604CF7
GetVersion.KERNEL32 ref: 00604D0B
GetVersion.KERNEL32 ref: 00604D1C
GetCurrentThreadId.KERNEL32 ref: 00604D58

Part of subcall function 00602F04: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00602F26
Part of subcall function 00602F04: RegQueryValueExA.ADVAPI32 ref: 00602F59
Part of subcall function 00602F04: RegCloseKey.ADVAPI32(?), ref: 00602F6F

GetThreadLocale.KERNEL32 ref: 00604D38

Part of subcall function 00604BC8: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00604C2E), ref: 00604BEE

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 5427cc31308d50f8f58cb81c4086aa616b8e4a906fae4bce7af71f1dfe7d5ce2
Instruction ID: feb53608f4c1b4819b7fdf81e77006572a780a3a92dd732f2b90cdc25788172e
Opcode Fuzzy Hash: 5427cc31308d50f8f58cb81c4086aa616b8e4a906fae4bce7af71f1dfe7d5ce2
Instruction Fuzzy Hash: 600125F44C4341C5E76DBF60AC8674B3A639F13344F14B85DE2514A3E2EF754184976A

Function 00602F04 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00602F26
RegQueryValueExA.ADVAPI32 ref: 00602F59
RegCloseKey.ADVAPI32(?), ref: 00602F6F

Strings

FPUMaskValue, xrefs: 00602F50
SOFTWARE\Borland\Delphi\RTL, xrefs: 00602F1C

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: c522d6b20feab569b95bd321231a7b39662f5e31493b4586a0d9637fe5901882
Instruction ID: c03fda469428753ecf02ecefcce68b4b7182e76c56f88a0b924b5aea7086ba02
Opcode Fuzzy Hash: c522d6b20feab569b95bd321231a7b39662f5e31493b4586a0d9637fe5901882
Instruction Fuzzy Hash: 3601B5755C030AB9DB15DBE0CC56BFB77BDDB09744F5000A5BA04D65C0E6705A14D798

Function 0040203F Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 0040209D
GetFileType.KERNEL32 ref: 00402148
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004021AB
GetFileType.KERNEL32 ref: 004021B9
SetHandleCount.KERNEL32 ref: 004021F0

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 400b9e1c09f4c8b4246377677c855733b0a7004988ecaecd724ee2ff353f4308
Instruction ID: caac54b683a96beeea0f3893d81dbd00cf7c5e2421639fb466baf6c3d4da63b4
Opcode Fuzzy Hash: 400b9e1c09f4c8b4246377677c855733b0a7004988ecaecd724ee2ff353f4308
Instruction Fuzzy Hash: 7F5128315003028BD7108B28DE4C72A7BE1EB15324F25467ED656BF3E1DBB88806CB59

Function 00606D64 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00606DFB,?,?,00000000), ref: 00606D7C

Part of subcall function 00606ADC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00606AFA

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00606DFB,?,?,00000000), ref: 00606DAC
EnumCalendarInfoA.KERNEL32(Function_00006CB0,00000000,00000000,00000004), ref: 00606DB7
GetThreadLocale.KERNEL32(00000000,00000003,00000000,00606DFB,?,?,00000000), ref: 00606DD5
EnumCalendarInfoA.KERNEL32(Function_00006CEC,00000000,00000000,00000003), ref: 00606DE0

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 64468f9e38e86cbae6d5be39c18cfd5a5062b6d04b52a85de6321f918ccf37d8
Instruction ID: 351a49cc6eeb8d263ff2a59df9ed8983b84ceb925ca044530df0050181d320a2
Opcode Fuzzy Hash: 64468f9e38e86cbae6d5be39c18cfd5a5062b6d04b52a85de6321f918ccf37d8
Instruction Fuzzy Hash: 940126757C42486BE319FBB0CC13B5B765FEF85720F510564F600E66C2EA659E1082A9

Function 00402262 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 00402264
TlsGetValue.KERNEL32(?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 00402272
SetLastError.KERNEL32(00000000,?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 004022BE

Part of subcall function 004030C5: HeapAlloc.KERNEL32(00000008,?,?,?,?,0040221A,00000001,00000074,?,00401836), ref: 0040311A

TlsSetValue.KERNEL32(00000000,?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 00402296
GetCurrentThreadId.KERNEL32(?,00000000,00401A42,00000000,?,?,?,004018C0,?,?,00000000,00000000), ref: 004022A7

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 335a875935f7b19f5e8a0b5442704e984695624e2c3f9a47eb943db27249e189
Instruction ID: f9de0d5041fc25c08b20143062fd2b82a10856d808b46f2208d999d265b65f83
Opcode Fuzzy Hash: 335a875935f7b19f5e8a0b5442704e984695624e2c3f9a47eb943db27249e189
Instruction Fuzzy Hash: 0BF0BB32601A115BD7312F71BF0DA5F3A54EF01B71715027EF945BA2E0DB7988014AE8

Function 00606E14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00606FDE,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00606E43

Part of subcall function 00606ADC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00606AFA

Strings

ggg, xrefs: 00606F28
yyyy, xrefs: 00606F35
eeee, xrefs: 00606F4E

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: b291cb8597261f6514058d5d14fcbabcc4e1ef7db54b89a8c03662ca38e12f5f
Instruction ID: 549bb3956218e062135398211ae85f01a1fb8ae2f528c7acbdc3c2fb8c59784f
Opcode Fuzzy Hash: b291cb8597261f6514058d5d14fcbabcc4e1ef7db54b89a8c03662ca38e12f5f
Instruction Fuzzy Hash: 254103357C82164BD71DAB78C8816BFF7ABDB84300B604569F442D33C6DA70EE16C669

Function 00606B8C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00606C9F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00606BA8

Strings

Q`, xrefs: 00606BE9
DR`, xrefs: 00606C35
|R`, xrefs: 00606C5A

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: LocaleThread
String ID: DR`$|R`$Q`
API String ID: 635194068-1853681101
Opcode ID: 06f649347e903f645061d77f2fb1060dac145866f74880fa77775b5ebe0026ea
Instruction ID: 239d570031dca18a3b836607bbb55e997dcfd0203a85c96b2fac2a33e89f6fe5
Opcode Fuzzy Hash: 06f649347e903f645061d77f2fb1060dac145866f74880fa77775b5ebe0026ea
Instruction Fuzzy Hash: B131B471F801085BD708DA95C891BAF77AFDB88310F11447AFA09D73C1DA35ED1187A9

Function 00608DD8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000), ref: 00608E0A

Part of subcall function 00608D40: lstrcmpA.KERNEL32(?,?), ref: 00608D95

Strings

LvwsvwGfavdPwqjmdB, xrefs: 00608E19
Hfqmfo01, xrefs: 00608DF7
that made me looool, xrefs: 00608E36

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: LibraryLoadlstrcmp
String ID: Hfqmfo01$LvwsvwGfavdPwqjmdB$that made me looool
API String ID: 2493137890-1512227557
Opcode ID: ac9e2763bc583bae6a6ae1e0cdd70218bde24cb25572d77f1616a3f6bdbf989c
Instruction ID: 91cfcea0a7c87a67f9c2548e482a2e6c48ff6f34df040ee4925186b5e68baebf
Opcode Fuzzy Hash: ac9e2763bc583bae6a6ae1e0cdd70218bde24cb25572d77f1616a3f6bdbf989c
Instruction Fuzzy Hash: BEF081307807146FE348EBA4CC12B5F7AAEDB85740F510478F580977C2DE749E008668

Function 00608288 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00608799,00000000,006087AC), ref: 0060828E
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA,kernel32.dll,?,00608799,00000000,006087AC), ref: 0060829F

Strings

GetDiskFreeSpaceExA, xrefs: 00608299
kernel32.dll, xrefs: 00608289

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 3d83e3763f9cb26a47f97c377c5ba6a369e8466b53bdeef0079a243f54f614f4
Instruction ID: 5e6b4c9483f2f7c51195c5a922daefa23dd3e15a114a57c8b2c2df2eadd9ead3
Opcode Fuzzy Hash: 3d83e3763f9cb26a47f97c377c5ba6a369e8466b53bdeef0079a243f54f614f4
Instruction Fuzzy Hash: 41D09EB06C1F469EF718EBE15C85613359F9740349F40A429B143472D1EEA589445FE5

Function 006087BC Relevance: 6.4, Strings: 5, Instructions: 176COMMON

Download Yara Rule

Strings

LEN, xrefs: 00608865
Cv1b65s4fhs5g, xrefs: 00608901
LET, xrefs: 00608877
LeN2, xrefs: 006088D5
LEK, xrefs: 00608853

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID:
String ID: Cv1b65s4fhs5g$LEK$LEN$LET$LeN2
API String ID: 0-540611677
Opcode ID: ebd5129da31cb8bec77683622b2556c110d4d57b298ed4dd0b3c90598997d42e
Instruction ID: 303b0df73370c22c81846fce0fc5bee04f2d4bd8b943fa37c21e1f5f327a566b
Opcode Fuzzy Hash: ebd5129da31cb8bec77683622b2556c110d4d57b298ed4dd0b3c90598997d42e
Instruction Fuzzy Hash: A3517430A841495FDF89EBA4C8429DFB7B7EF55300F5040A9E481A73D2DE749E06CB59

Function 006087F8 Relevance: 6.4, Strings: 5, Instructions: 136COMMON

Download Yara Rule

Strings

LEN, xrefs: 00608865
Cv1b65s4fhs5g, xrefs: 00608901
LET, xrefs: 00608877
LeN2, xrefs: 006088D5
LEK, xrefs: 00608853

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: LibraryLoad
String ID: Cv1b65s4fhs5g$LEK$LEN$LET$LeN2
API String ID: 1029625771-540611677
Opcode ID: dc3abd6f085aa029bf8dc6caa9084fddafc0af94d937e161695d8a450c00fc25
Instruction ID: fbcd3e01223230a3ddce9288ca9acb4f485afac74d0806ade84b1f33029c4d3b
Opcode Fuzzy Hash: dc3abd6f085aa029bf8dc6caa9084fddafc0af94d937e161695d8a450c00fc25
Instruction Fuzzy Hash: 6A412130A805095FDF88FB94C882ADFB7B7EF44300F504569E481A73D2DE74AE468B59

Function 00607D6C Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeExA.KERNEL32(?,00000002,?,00000080,?), ref: 00607E66
GetThreadLocale.KERNEL32 ref: 00607D96

Part of subcall function 00607CF4: GetCPInfo.KERNEL32(00000000,?), ref: 00607D0D

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: c20fea7ece837fd4a4d4c232880b2c9fb4836bd1c3298877a86fcb63a872c9ac
Instruction ID: 031fbc90ea44a9d57a695ee475c96b9f8855e0aa644ccf8bf3c3245cd95ddff9
Opcode Fuzzy Hash: c20fea7ece837fd4a4d4c232880b2c9fb4836bd1c3298877a86fcb63a872c9ac
Instruction Fuzzy Hash: 84312621EC93858BD764DB64EC017A73FA7EB91305F04A0D9E9448B3D2EB346C49C766

Function 004017C6 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 004017EC

Part of subcall function 004022C9: HeapCreate.KERNELBASE(00000000,00001000,00000000,00401824,00000001), ref: 004022DA
Part of subcall function 004022C9: HeapDestroy.KERNEL32 ref: 004022F8

GetCommandLineA.KERNEL32 ref: 0040184C
GetStartupInfoA.KERNEL32 ref: 00401877
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040189A

Part of subcall function 004018F3: ExitProcess.KERNEL32 ref: 00401910

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 580e609f3b58203afaf02fb415f8282007d0353eaa0aedd914cb555909b1db8c
Instruction ID: 7f32cd8fe34967029b0e80cb92399a2b70a2c6a079cbf2585e16a7e0bb248895
Opcode Fuzzy Hash: 580e609f3b58203afaf02fb415f8282007d0353eaa0aedd914cb555909b1db8c
Instruction Fuzzy Hash: 3E2160B19407059BDB08BBA5DD4AA6E7BA8FF04714F10403FF905BA2E1DB788940CB58

Function 00402998 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004029AC

Strings

, xrefs: 004029D1
, xrefs: 004029F5

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: eee52de4ef1d4b68b42ec2e047e9f4f22a41eb0dfe49c41ee4b0386842691e7c
Instruction ID: 926cd45f255bbb82106f54f5591ecb558f37e935955913c86844fdd4412d6bab
Opcode Fuzzy Hash: eee52de4ef1d4b68b42ec2e047e9f4f22a41eb0dfe49c41ee4b0386842691e7c
Instruction Fuzzy Hash: 88415A312042585AFB219B14DF4DBFB3FA9EB01704F1500F6D586F61D2C6B94A54CBAA

Function 006076BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0060787F), ref: 00607729
GetModuleFileNameA.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0060787F), ref: 0060774B

Part of subcall function 00604B70: LoadStringA.USER32 ref: 00604BA2

Strings

|Q`, xrefs: 006077D1

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: |Q`
API String ID: 902310565-1287144811
Opcode ID: f04f175d259c25fdcbc041710ef7f9a517576aab3b3a3207c45b177d1155a1ec
Instruction ID: 29300fce4ad5f21c6a0c8294c9238be0950d320ce33057e9c1de983e8ff0d5f7
Opcode Fuzzy Hash: f04f175d259c25fdcbc041710ef7f9a517576aab3b3a3207c45b177d1155a1ec
Instruction Fuzzy Hash: CE51D270A44658DFDB65DB68CD85BCAB7FAAB48300F4041E9E508AB391E770AE84CF51

Function 00604F9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32 ref: 00604FD9

Strings

first Window app, xrefs: 00604FD5
oloooool, xrefs: 00604FD6

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: CreateWindow
String ID: first Window app$oloooool
API String ID: 716092398-2688301056
Opcode ID: bf0f031763fedf2387eb07865909b2dcda5b1958d1a37e0667197b562cbda9e5
Instruction ID: 6bf7e3dfdf983de485033f2134917db6cee18bc32def7ed793967fc69823b713
Opcode Fuzzy Hash: bf0f031763fedf2387eb07865909b2dcda5b1958d1a37e0667197b562cbda9e5
Instruction Fuzzy Hash: C2F0AFB2704259BFDB94DE9DDC85E9B77ECEB8C2A0B004129BA0CD7241D630ED108BB4

Function 006019D0 Relevance: 5.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 006019E7
EnterCriticalSection.KERNEL32(0060B5C4,0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 006019FA
LocalAlloc.KERNEL32(00000000,00000FF8,0060B5C4,00000000,00601A98,?,?,?,006023F6), ref: 00601A24
LeaveCriticalSection.KERNEL32(0060B5C4,00601A9F,00000000,00601A98,?,?,?,006023F6), ref: 00601A92

Memory Dump Source

Source File: 00000002.00000002.371099227.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.371096001.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371102376.000000000060A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371105267.000000000060C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.371108196.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_25F.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: d83a478d0fbd83e8168573bd93e1b4583d2a59f1f9abd21cdc0df2ac30b95189
Instruction ID: 74df882c1a01e5d4aec3e25528a86efcb18e16bd6ea950092898227c461be41d
Opcode Fuzzy Hash: d83a478d0fbd83e8168573bd93e1b4583d2a59f1f9abd21cdc0df2ac30b95189
Instruction Fuzzy Hash: 671160B0AC4241AFD75DEF99CC15B5BBBE3DB4A300F14E4A9A1009B3D1C7754D418B58

Function 00402664 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402671
InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402679
InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402681
InitializeCriticalSection.KERNEL32(?,00402201,?,00401836), ref: 00402689

Memory Dump Source

Source File: 00000002.00000002.370993339.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.370990312.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.370996454.0000000000407000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_25F.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: cf65fcc1aeab1ef7e16435afcb5f7beaf118cbbb08b94427fa8083d0bb468be8
Instruction ID: 48065476d1b059bde1b2936bcb0e38e24f7665c16bd3e9ed4f641355b81c547b
Opcode Fuzzy Hash: cf65fcc1aeab1ef7e16435afcb5f7beaf118cbbb08b94427fa8083d0bb468be8
Instruction Fuzzy Hash: 16C0E931A070249ACB513B75FE0484A3E25EB0426031640BAA5096203486331830DFD8

Analysis Process: 25F.tmp.exePID: 3380, Parent PID: 3356COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.8%
Total number of Nodes:	737
Total number of Limit Nodes:	24

Executed Functions

Function 00365A20 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 189
threadlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrEnumerateLoadedModules.NTDLL(00000000,00365040,g\6), ref: 00365B0D
CreateThread.KERNEL32(00000000,00000000,00365070,00000000,00000000,00000000), ref: 00365C03
CloseHandle.KERNEL32(00000000), ref: 00365C0A
CreateThread.KERNEL32(00000000,00000000,003650F0,00000000,00000000,00000000), ref: 00365C3D
CloseHandle.KERNEL32(00000000), ref: 00365C44

Part of subcall function 00363920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 00363962

Strings

ntdll.dll, xrefs: 00365B22, 00365B40
LdrLoadDll, xrefs: 00365B3B
NtResumeThread, xrefs: 00365B1D
g\6, xrefs: 00365AA7, 00365AB8
g\6, xrefs: 00365AF4, 00365AFD

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CloseCreateHandleStringThread$AnsiEnumerateLoadedModulesUnicode
String ID: LdrLoadDll$NtResumeThread$g\6$g\6$ntdll.dll
API String ID: 1691487058-1552861057
Opcode ID: 19032fc6d19f31b1a0fcfd54ade410f2cfd92bb80e1c9f8976351988598bdf00
Instruction ID: b1b5cff40bcc17cd21162c59e12561d87a5f1172ec8b209b1d8d2f610696a0e5
Opcode Fuzzy Hash: 19032fc6d19f31b1a0fcfd54ade410f2cfd92bb80e1c9f8976351988598bdf00
Instruction Fuzzy Hash: DD61E375B40B02ABDB22DF68CC81FA673A8BF44704F168529E805DB789D771F901CB94

Function 00404C20 Relevance: 12.1, APIs: 8, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcessToken.ADVAPI32(00000000,00000028,?,00404E7E,SeDebugPrivilege,00000001,00000000,ntdll.dll,NtGetNextProcess), ref: 00404C32
GetLastError.KERNEL32 ref: 00404C3C
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00404C52
GetLastError.KERNEL32 ref: 00404C5C
CloseHandle.KERNEL32(?), ref: 00404C66

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLast$CloseHandleLookupOpenPrivilegeProcessTokenValue
String ID:
API String ID: 1673749002-0
Opcode ID: f03f0848109c1344e6a2f5cf10159e03204b2a801caeae268af0c0d772a4c6b3
Instruction ID: cd08b55a34506c6a1006ed51419cf0447f88819c37ae619cecf6d360b10e5dd7
Opcode Fuzzy Hash: f03f0848109c1344e6a2f5cf10159e03204b2a801caeae268af0c0d772a4c6b3
Instruction Fuzzy Hash: AF115175A00208ABDB10DBA4DC09FAEBBB8EB4D705F018569FB09E6290DA719E048765

Function 004042E0 Relevance: 10.6, APIs: 7, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566e3e481d76894f5171262dd43e3c3fbe6268a2b3aa79397b897dea9fa663b3
Instruction ID: 17ae2c20974ab2b3a02811892eedffa6f42bd494a781ace9a9728c4982da2f5b
Opcode Fuzzy Hash: 566e3e481d76894f5171262dd43e3c3fbe6268a2b3aa79397b897dea9fa663b3
Instruction Fuzzy Hash: 9F3186B17002046BD7209F6AEC41F6BB7ACEB84751F14457AFE09E73D0DA75ED0086A8

Function 00404D00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NtGetNextProcess, xrefs: 00404E58
SeDebugPrivilege, xrefs: 00404E6F
ntdll.dll, xrefs: 00404E5D

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID:
String ID: NtGetNextProcess$SeDebugPrivilege$ntdll.dll
API String ID: 0-503679825
Opcode ID: c4a0804236e7788b4098f7f275e0abd03e10ea5118c1f2739568c315aa77eb9b
Instruction ID: 5ed088abe51bc9704de4a451be291cc52f30af1fc387e08d9dd35c0f4901fdcf
Opcode Fuzzy Hash: c4a0804236e7788b4098f7f275e0abd03e10ea5118c1f2739568c315aa77eb9b
Instruction Fuzzy Hash: B831DBF0A4430476D620BFB69C07BAE3658AF44709F00547BFA84B72D2EEBD564097AD

Function 00364D00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ntdll.dll, xrefs: 00364E5D
SeDebugPrivilege, xrefs: 00364E6F
NtGetNextProcess, xrefs: 00364E58

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID:
String ID: NtGetNextProcess$SeDebugPrivilege$ntdll.dll
API String ID: 0-503679825
Opcode ID: 959a34c09acb6bbde116e028ea15d575a48bcba2001aef82aee4aca5b1ef8165
Instruction ID: d985b870f33fec2ea17a322ac20dd4c82274ce4c4112a81b87e434a2f0ce7684
Opcode Fuzzy Hash: 959a34c09acb6bbde116e028ea15d575a48bcba2001aef82aee4aca5b1ef8165
Instruction Fuzzy Hash: 3131EA70E54204B6D723BBB9AC07BEE325C9B05B00F00C456F948AB3C6FEB55A4087A9

Function 004056E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 00405741
NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 0040578B

Strings

(mA, xrefs: 00405795

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: InformationQuerySystem
String ID: (mA
API String ID: 3562636166-412592806
Opcode ID: 54551fad4c689b88b6c56286297f79b65224b9cbcfa60a58bb591db8606bca24
Instruction ID: cd5f570840ed0612bd24c40dad0ef41f87404906c4f3f406656de7144237ac50
Opcode Fuzzy Hash: 54551fad4c689b88b6c56286297f79b65224b9cbcfa60a58bb591db8606bca24
Instruction Fuzzy Hash: 62418375A00619ABDB10DBA4DD81FBFB3B8EB88704F04456DE905A7380E678ED44DBA4

Function 00404160 Relevance: 4.6, APIs: 3, Instructions: 122memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,00000000,00000000,00003000,00000040,00000000,?,?,?), ref: 00404192
WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0040424F
VirtualFreeEx.KERNEL32(?,00000000,00000000,00008000), ref: 0040427C

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Virtual$AllocFreeMemoryProcessWrite
String ID:
API String ID: 3247110995-0
Opcode ID: 02f7cf14a14e9807913e6e7e1cc57f194bdd3776d6a4df443f608aa8a8b972a6
Instruction ID: 66c8841409591aed13a986a2bc30d40898740935292764979a82c35a27653c4f
Opcode Fuzzy Hash: 02f7cf14a14e9807913e6e7e1cc57f194bdd3776d6a4df443f608aa8a8b972a6
Instruction Fuzzy Hash: 1C31B0F2A00218ABCB20DFA5EC85B6FB768EB84754B05457DFE0977341D634EE048A98

Function 00365C50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00365A20: LdrEnumerateLoadedModules.NTDLL(00000000,00365040,g\6), ref: 00365B0D

NtQueryInformationProcess.NTDLL(00000000,0000001B,?,00000800,00000000), ref: 00365C80

Part of subcall function 003649F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,003673CC,00397C98,00000000,00000000,00000010,00000000), ref: 00364A10
Part of subcall function 003649F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00364A77

Strings

STFU, xrefs: 00365CB8, 00365CBB

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: EnumerateInformationLoadedModulesMutexObjectProcessQueryReleaseSingleWait
String ID: STFU
API String ID: 2599885325-778810564
Opcode ID: 7c343b45f06b9c4611cd96e8dc4ba06767e0b6b014b8d2ca954ea7f556f982d8
Instruction ID: 28b673313a99262b3ef8c2a54ff46bac9cdcf8adf4d0c41bea9d4c55dfd22623
Opcode Fuzzy Hash: 7c343b45f06b9c4611cd96e8dc4ba06767e0b6b014b8d2ca954ea7f556f982d8
Instruction Fuzzy Hash: 6301ACB1A403086AEB51EBA49C03FBB72ECEB05700F00C1A5BA44EB180FE719954C7E5

Function 00410910 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 172
sleepstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00410930
GetProcessHeap.KERNEL32 ref: 0041093D
memset.MSVCRT ref: 0041095D
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00410982
ShellExecuteA.SHELL32(00000000,OPEN,00000000,00000000,00000000,00000005), ref: 004109BF

Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A

GetTickCount.KERNEL32 ref: 004109CF
Sleep.KERNELBASE ref: 00410A05
OpenMutexA.KERNEL32 ref: 00410A17
GetLastError.KERNEL32 ref: 00410A27
GetLastError.KERNEL32 ref: 00410A2E
ExitProcess.KERNEL32 ref: 00410A32
lstrlenA.KERNEL32(30e44aa1), ref: 00410A3D
_snprintf.MSVCRT ref: 00410A60
ExitProcess.KERNEL32 ref: 00410A79
ExitProcess.KERNEL32 ref: 00410A98
GetModuleFileNameW.KERNEL32(00000000,0044AFB0,00000208), ref: 00410ACC
wsprintfW.USER32 ref: 00410ADE
WideCharToMultiByte.KERNEL32(00000000,00000000,0044ADA0,000000FF,0044AC50,00000104,00000000,00000000), ref: 00410B06
lstrcpynW.KERNEL32(0044B1B8,00000000,00000208), ref: 00410B13
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,0044B3E0,00000104,00000000,00000000), ref: 00410B2E
Sleep.KERNELBASE(000009C4), ref: 00410B59
ExitProcess.KERNEL32 ref: 00410B70

Strings

running, xrefs: 00410A7F, 00410A9E
ngrBot, xrefs: 00410A84, 00410AA3
%s\Microsoft\%s.exe, xrefs: 00410AD4
%08x, xrefs: 00410A4F
OPEN, xrefs: 004109B8
30e44aa1, xrefs: 00410A38, 00410A44

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Process$Exitmemset$lstrlen$ByteCharErrorFileLastModuleMultiNameSleepWide_snprintf$CountExecuteHeapMutexOpenShellTick_vsnprintflstrcpynwsprintf
String ID: %08x$%s\Microsoft\%s.exe$30e44aa1$OPEN$ngrBot$running
API String ID: 2173303953-2917108782
Opcode ID: 3f17dcce76c53ba9253c23bd9188473ab1a318a1f66791ecfc87204156b81db0
Instruction ID: 4ffe1fa680e8cfeee387428967875dcc16e730cc5b6ba411c3a4c92c7f9556b3
Opcode Fuzzy Hash: 3f17dcce76c53ba9253c23bd9188473ab1a318a1f66791ecfc87204156b81db0
Instruction Fuzzy Hash: 9F51C775E84304BBE710ABB19C0BFDA3A689B54B05F148076F709F61D1DAF856C0876E

Function 0040B300 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 129
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040B312
HeapAlloc.KERNEL32(00000000), ref: 0040B319
memset.MSVCRT ref: 0040B339
memset.MSVCRT ref: 0040B354
GetWindowsDirectoryW.KERNEL32(?,00000208), ref: 0040B387
lstrcpynW.KERNEL32(?,?,00000004), ref: 0040B3A1
GetVolumeInformationW.KERNELBASE ref: 0040B3BB
lstrlenA.KERNEL32(30e44aa1), ref: 0040B3D8
lstrlenA.KERNEL32(30e44aa1), ref: 0040B3F0
lstrcatW.KERNEL32(00000000,.exe), ref: 0040B461

Strings

.exe, xrefs: 0040B45B
lol, xrefs: 0040B371
lol.exe, xrefs: 0040B366
30e44aa1, xrefs: 0040B3D3, 0040B3EA

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heaplstrlenmemset$AllocDirectoryInformationProcessVolumeWindowslstrcatlstrcpyn
String ID: .exe$30e44aa1$lol$lol.exe
API String ID: 1748614950-52295467
Opcode ID: d3657b4a80b9d4a6581e6a83d54c6d066d10b995bc1c007895724c77d5465172
Instruction ID: 8b3afc46e6e6bf4e113eda6340ead4404c7cc4be090bb0c5156ba26052e09737
Opcode Fuzzy Hash: d3657b4a80b9d4a6581e6a83d54c6d066d10b995bc1c007895724c77d5465172
Instruction Fuzzy Hash: 3A41F771601314A6C7208B668C05AEFBBB9EF88311F14C1A7FA18D6191E7B88A50D7AD

Function 00404AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111
synchronizationstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 00404B1A
sprintf.MSVCRT ref: 00404B2C
CreateMutexA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00404B3F
_snprintf.MSVCRT ref: 00404B6F
OpenFileMappingA.KERNEL32 ref: 00404B85
CloseHandle.KERNEL32(00000000), ref: 00404B97
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404BE3
ReleaseMutex.KERNEL32(?,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404C02

Strings

%s_0, xrefs: 00404B5E
-%sMutex, xrefs: 00404B26

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Mutex$CloseCreateFileHandleMappingObjectOpenReleaseSingleWait_snprintfsprintfstrncpy
String ID: %s_0$-%sMutex
API String ID: 4144850300-892854768
Opcode ID: ecddfadb3e7974d3b479c769f3db4150c2fa8099748c697d7ff10cc592852ed6
Instruction ID: f71ab11216f24301a232ac9e3dee7d330e97c1bd754f36d27f0bed8dafa8c0fd
Opcode Fuzzy Hash: ecddfadb3e7974d3b479c769f3db4150c2fa8099748c697d7ff10cc592852ed6
Instruction Fuzzy Hash: 54313AF16003046BD710AF659C81FDBB7AC9F84714F04857BFF48A72D0EAB5E9848698

Function 00364AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111
synchronizationstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 00364B1A
sprintf.MSVCRT ref: 00364B2C
CreateMutexA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00364B3F
_snprintf.MSVCRT ref: 00364B6F
OpenFileMappingA.KERNEL32 ref: 00364B85
CloseHandle.KERNELBASE(00000000), ref: 00364B97
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00364BE3
ReleaseMutex.KERNEL32(?,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00364C02

Strings

-%sMutex, xrefs: 00364B26
%s_0, xrefs: 00364B5E

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Mutex$CloseCreateFileHandleMappingObjectOpenReleaseSingleWait_snprintfsprintfstrncpy
String ID: %s_0$-%sMutex
API String ID: 4144850300-892854768
Opcode ID: f6845b6598138032d7c7dc84486543f734c93618186e9de6dfc106e31b73ec49
Instruction ID: 13a83959ea67d68d94bc2c7a3f1d2e2484e6cf9836644424c9859b1f75063f7d
Opcode Fuzzy Hash: f6845b6598138032d7c7dc84486543f734c93618186e9de6dfc106e31b73ec49
Instruction Fuzzy Hash: 06312CB2A00204ABD7219F68DC42FDA77EC9F44710F04C559FE4D9B184EAB1D9848690

Function 0040F2B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403810: GetProcessHeap.KERNEL32(00000000,00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403819
Part of subcall function 00403810: RtlAllocateHeap.NTDLL(00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403820

sprintf.MSVCRT ref: 0040F2E9
CreateFileA.KERNELBASE(00000000,00000000,00000003,00000000,00000003,00000000,00000000), ref: 0040F2FA
memset.MSVCRT ref: 0040F323
DeviceIoControl.KERNELBASE(00000000,002D1400,004109A7,0000000C,?,00000400,00000000,00000000), ref: 0040F352
CloseHandle.KERNELBASE(00000000), ref: 0040F35B

Strings

\\.\%c:, xrefs: 0040F2E3

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$AllocateCloseControlCreateDeviceFileHandleProcessmemsetsprintf
String ID: \\.\%c:
API String ID: 3888047447-1260769427
Opcode ID: ff8d1dc2011cb1bfb04a541e805314c1674ac90d9df941c15e93383af5fb76e0
Instruction ID: 06110f1b05a4b9b3a9b8087ee69a5e127bd0aec849f1c9d495b94b1698777b9d
Opcode Fuzzy Hash: ff8d1dc2011cb1bfb04a541e805314c1674ac90d9df941c15e93383af5fb76e0
Instruction Fuzzy Hash: D42198F19002087BD720DF959C85EFFB77CEB45754F0041BAFA08A6281D6B40F8546A5

Function 00404560 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.MSVCRT ref: 004045D5
CreateFileMappingA.KERNEL32 ref: 004045FD
MapViewOfFile.KERNELBASE(?,000F001F,00000000,00000000,00000000,?,?,00010000,EDB88320,00000000), ref: 00404636

Strings

%s_%d, xrefs: 004045C4

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: File$CreateMappingView_snprintf
String ID: %s_%d
API String ID: 1261873476-1933919280
Opcode ID: 6e13bc5d45006f82416d3cdcea8d38f2c487028171e142ebaa6c825697568e61
Instruction ID: 2d1e0240a6dfd40e8f44cae7654bdf04abfd26f7ecc1aa1406215c6cd6b15d06
Opcode Fuzzy Hash: 6e13bc5d45006f82416d3cdcea8d38f2c487028171e142ebaa6c825697568e61
Instruction Fuzzy Hash: D761D1B16002029BD325CF18C881BB6B7E5FF84304F28857DE7869B3C5D779A9A0DB84

Function 00404470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.MSVCRT ref: 004044A7
OpenFileMappingA.KERNEL32 ref: 004044BD
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 004044F0
CloseHandle.KERNEL32(?), ref: 0040451B

Strings

%s_%d, xrefs: 00404496

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: File$CloseHandleMappingOpenView_snprintf
String ID: %s_%d
API String ID: 460513966-1933919280
Opcode ID: 61360a09ed2803673541f69b6359b1b42ff6b64d8add12aeef0c8aaee9439e27
Instruction ID: 26658a841a1a3fe0c79036ba11ef289e621c3937bfc9ce10cfabfd1764c09018
Opcode Fuzzy Hash: 61360a09ed2803673541f69b6359b1b42ff6b64d8add12aeef0c8aaee9439e27
Instruction Fuzzy Hash: D421CFB26507069BD332CF08DC89BB2B3E8EB84304F40857DA74297685DB7DB8609B44

Function 00364470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.MSVCRT ref: 003644A7
OpenFileMappingA.KERNEL32 ref: 003644BD
MapViewOfFile.KERNELBASE(?,000F001F,00000000,00000000,00000000), ref: 003644F0
CloseHandle.KERNEL32(?), ref: 0036451B

Strings

%s_%d, xrefs: 00364496

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: File$CloseHandleMappingOpenView_snprintf
String ID: %s_%d
API String ID: 460513966-1933919280
Opcode ID: 09d3326afe10ba9e3c1556f8076e5b3272bdbf8ed317bf4125bb0d0c1dd3eab7
Instruction ID: b30cc3a35b5f5323400945fff8a605ffdcde548691ac8cee4e6df1d32a149de9
Opcode Fuzzy Hash: 09d3326afe10ba9e3c1556f8076e5b3272bdbf8ed317bf4125bb0d0c1dd3eab7
Instruction Fuzzy Hash: 3F21A1B26507068BD332DF18DD89B72B3E8EB84304F54857CE74697689DB79B860DB40

Function 00403F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,00000000,kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,00404D5C), ref: 00404007

Strings

GetNativeSystemInfo, xrefs: 00403FBD
kernel32.dll, xrefs: 00403FC2

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: InfoNativeSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 1721193555-192647395
Opcode ID: 7e7b4dbe53be81b1ab4fbd66654e37c01d7587515854f1dbf4a1af964dd22a61
Instruction ID: 791685a111bc0c6a63c3f367ca410b207a7afd2459317f5c88c0cf7fc5170385
Opcode Fuzzy Hash: 7e7b4dbe53be81b1ab4fbd66654e37c01d7587515854f1dbf4a1af964dd22a61
Instruction Fuzzy Hash: AD01D7F1C083099ADB18EFAAA94129E7AF8AB48305F14947FA108B27A0D7795740CB5D

Function 00363F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,00000000,kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,00364D5C), ref: 00364007

Strings

GetNativeSystemInfo, xrefs: 00363FBD
kernel32.dll, xrefs: 00363FC2

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: InfoNativeSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 1721193555-192647395
Opcode ID: b0a350e98190940a74d8676a70d061d02807f0e69dd023b19da8d82e8d8b11b3
Instruction ID: 0ab82d23c1c70e3812e367bb40e75695c242a2224af08a400e748f2b43502662
Opcode Fuzzy Hash: b0a350e98190940a74d8676a70d061d02807f0e69dd023b19da8d82e8d8b11b3
Instruction Fuzzy Hash: EB010CB1C093099ACF1AEFA9A90119DBBF8AB08300F00846FE008A7794DB765740CB59

Function 004068B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00449E78,00000026,00000001), ref: 004068BB
PathAppendW.SHLWAPI(00449E78,Internet Explorer\iexplore.exe), ref: 004068D0

Strings

Internet Explorer\iexplore.exe, xrefs: 004068C6

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Path$AppendFolderSpecial
String ID: Internet Explorer\iexplore.exe
API String ID: 2921508639-3330628412
Opcode ID: a335c27866ef2bae4a09bd65796f17ffb87ef9b2b152ac25fa9b155a7e5f3500
Instruction ID: 5cef3b0c70042a609627615c00b92cc7df0f9fd812bc402db1849e33514db50e
Opcode Fuzzy Hash: a335c27866ef2bae4a09bd65796f17ffb87ef9b2b152ac25fa9b155a7e5f3500
Instruction Fuzzy Hash: C1C0C9253D030026E61057144D8ABC22241A774B42FA081A2B202A41E0D3ED4881200E

Function 00404410 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(0000047A,00000000,00000000,?,?,004057DF,?,00000000,00000000,(mA,?,?,?,?), ref: 00404430
GetLastError.KERNEL32(?,004057DF,?,00000000,00000000,(mA,?,?,?,?,?,?,?,?,?,00406010), ref: 0040443C

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLastOpenProcess
String ID:
API String ID: 919517065-0
Opcode ID: fa21c6a546f7665fcd9ed43f9efed41023edd3376a29bcc8ba8710a23aa8e6cc
Instruction ID: 0bc3cb10323a7717dc5adc9e31d89cd4ea32d10fdc1a18813f8fb21e42cac110
Opcode Fuzzy Hash: fa21c6a546f7665fcd9ed43f9efed41023edd3376a29bcc8ba8710a23aa8e6cc
Instruction Fuzzy Hash: E2F089766401146BD7106BB5BC05EAB779CDBC4395B044036FB0CD3750D5749900C6A9

Function 0040A990 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48processCOMMON

Download Yara Rule

APIs

Part of subcall function 004068B0: SHGetSpecialFolderPathW.SHELL32(00000000,00449E78,00000026,00000001), ref: 004068BB

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 0040A9ED

Strings

D, xrefs: 0040A9B6

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CreateFolderPathProcessSpecial
String ID: D
API String ID: 2112413627-2746444292
Opcode ID: 835663ffea5eee61987b87af985e6251e3cfc9ab47c548749ea0a7200375bfe3
Instruction ID: 2230c3a86171d276420a58e3022d5c119255fdd01a2dfc7308d6bdfabee464bf
Opcode Fuzzy Hash: 835663ffea5eee61987b87af985e6251e3cfc9ab47c548749ea0a7200375bfe3
Instruction Fuzzy Hash: 5501A272A4031876EB20DAD58C02FEF7B2C9B04B14F14415AFB097B1C5EAB969548399

Function 00403810 Relevance: 3.0, APIs: 2, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403819
RtlAllocateHeap.NTDLL(00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403820

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: baacf28b722c80f1d97f843805acf95dbcbf5d56b1c562bccd72c9ce7d042db9
Instruction ID: a45d09a1cc6a3363d10043362d83d70e5a190bee85998ff93397d4509dba2002
Opcode Fuzzy Hash: baacf28b722c80f1d97f843805acf95dbcbf5d56b1c562bccd72c9ce7d042db9
Instruction Fuzzy Hash: B6C09B75144708BBE7005BF4EC0DFD5775CD70C612F408010FB1DC6260C671A4404765

Function 00403830 Relevance: 2.5, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,?,00402D43,?,00000100,?,(mA,?,?,00405730,?,00008000,?,00000000), ref: 0040384F
HeapReAlloc.KERNEL32(00000000,?,00402D43,?,00000100,?,(mA,?,?,00405730,?,00008000,?,00000000,00000000,?), ref: 00403856

Part of subcall function 00403810: GetProcessHeap.KERNEL32(00000000,00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403819
Part of subcall function 00403810: RtlAllocateHeap.NTDLL(00000000,?,00404046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00403820

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 6bd858bd068ee9d502431d5df6c01d659be59e0546fa1d939306a6d2d7cd13d1
Instruction ID: 59b5348fdb67c635b3c04655c960773e447a90c549b0dc0aa948b3716d5f6312
Opcode Fuzzy Hash: 6bd858bd068ee9d502431d5df6c01d659be59e0546fa1d939306a6d2d7cd13d1
Instruction Fuzzy Hash: 20D05BB65002087BEF00AFE4FC49EAA3B9CDB48615F44C065FB0DC7650D635E9008755

Function 004037F0 Relevance: 2.5, APIs: 2, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0040428C,?,0040428C,00000000), ref: 004037F9
HeapFree.KERNEL32(00000000,?,0040428C), ref: 00403800

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 38296f158267b1ebc2d54f92307be93bf0282fd4a93306e7a804a0f77be8d180
Instruction ID: 9b6b654b7b719752d2f106a16efdcbfd3e8252ceaa65f6ec648e1aaeb866a5ce
Opcode Fuzzy Hash: 38296f158267b1ebc2d54f92307be93bf0282fd4a93306e7a804a0f77be8d180
Instruction Fuzzy Hash: 7DC09B7514430CBBDB005BE4EC0DFD5775CE70C641F40C010F70DC6160C671A4004765

Function 004030C0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(EDB8830C,00010000,EDB88320), ref: 004030EB

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 1ec5181adca8729c0b4d054fe9820a29ef9486c1db9cb2112205f76210c3a441
Instruction ID: f882fd944f5205b9f6397f97525e7b153576b9ce51f1a3dc64d4837ac45731b1
Opcode Fuzzy Hash: 1ec5181adca8729c0b4d054fe9820a29ef9486c1db9cb2112205f76210c3a441
Instruction Fuzzy Hash: 88E04F31501725ABDB205F189C02B8B7B9CAF04751F044036FD08A7782E774EA0047D8

Function 004042A0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

IsWow64Process.KERNELBASE(00000000,00000000,?,?,00404309,00000000,00000000,00000000,00000000), ref: 004042B5

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ProcessWow64
String ID:
API String ID: 2092917072-0
Opcode ID: 22b2903508e7e7fa1c50625dbd83016fe9164760df05acc8bbb1288eadc8f59e
Instruction ID: 2da779ddd16944dc38780d38c887f2d19e27236ab7e8ad125095d7b4c023789d
Opcode Fuzzy Hash: 22b2903508e7e7fa1c50625dbd83016fe9164760df05acc8bbb1288eadc8f59e
Instruction Fuzzy Hash: 5AE08CB072021CABDB30CB90DC04BAA73ACD740349F0002FEBE0892690E63ADE44CB94

Function 00406850 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00449A68,0000001A,00000001), ref: 0040685B

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: FolderPathSpecial
String ID:
API String ID: 994120019-0
Opcode ID: 719606b9710c54ecf9254484d1c63c70ec4c7ebb7d3140fe275e23f379cb05b4
Instruction ID: dec42c56a20302e498460b79d113f6e88d44876573d08d8c81d581d4537f89bd
Opcode Fuzzy Hash: 719606b9710c54ecf9254484d1c63c70ec4c7ebb7d3140fe275e23f379cb05b4
Instruction Fuzzy Hash: 3BB092313F434521FA101A788C07FC121486325F03F9082617282F80E0C2DC8D80A20B

Non-executed Functions

Function 0040B480 Relevance: 66.9, APIs: 28, Strings: 10, Instructions: 363memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B4A2

Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A

lstrcpyA.KERNEL32(?,00411335), ref: 0040B51A
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0040B536
GetVersionExA.KERNEL32(?), ref: 0040B550
lstrcpyA.KERNEL32(?,ERR), ref: 0040B5F5
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0040B60D
strstr.MSVCRT ref: 0040B641
lstrlenA.KERNEL32(00000000), ref: 0040B650
lstrlenA.KERNEL32(-00000004), ref: 0040B65F
GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0040B67D
lstrcmpA.KERNEL32(-00000004,00412BE4), ref: 0040B6A8
GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0040B6C5
lstrcpyA.KERNEL32(?,00000000), ref: 0040B719
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0040B74A

Part of subcall function 00401BA0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00401BC5

HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0040B75B
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0040B76E
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0040B781
_snprintf.MSVCRT ref: 0040B796
_snprintf.MSVCRT ref: 0040B7AB
lstrcpyA.KERNEL32(?,00412C0C), ref: 0040B7CD
_snprintf.MSVCRT ref: 0040B7FC
_snprintf.MSVCRT ref: 0040B863
_snprintf.MSVCRT ref: 0040B878
lstrcpyA.KERNEL32(?,00412C0C), ref: 0040B89A
_snprintf.MSVCRT ref: 0040B8C9
_snprintf.MSVCRT ref: 0040B8E0
??3@YAXPAX@Z.MSVCRT(?), ref: 0040B8F3

Strings

, xrefs: 0040B63B
admin, xrefs: 0040B4AE
ERR, xrefs: 0040B5E4, 0040B5EC, 0040B68A, 0040B6CF, 0040B706
[%s{%s%s{%s, xrefs: 0040B80B, 0040B8D5
http://api.wipmania.com/, xrefs: 0040B620
VIS, xrefs: 0040B5B2
2K8, xrefs: 0040B5BD, 0040B5D9
2K3, xrefs: 0040B593
isadmin, xrefs: 0040B4A9
n%s[%s{%s%s{%s, xrefs: 0040B7F1, 0040B8BE

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: _snprintf$AllocHeap$lstrcpy$lstrlen$memset$InfoLocaleTime$??3@FileSystemVersion_vsnprintflstrcmpstrstr
String ID: 2K3$2K8$ $ERR$VIS$[%s{%s%s{%s$admin$http://api.wipmania.com/$isadmin$n%s[%s{%s%s{%s
API String ID: 124843797-3058427118
Opcode ID: 5285a643bed9aead735775b7b57751fab33f7591493ea2bf5bbeeb1044d9239c
Instruction ID: 0949af502ffcd9305bdd3bfb05b668ef187342c133c2638009f109ee02911516
Opcode Fuzzy Hash: 5285a643bed9aead735775b7b57751fab33f7591493ea2bf5bbeeb1044d9239c
Instruction Fuzzy Hash: 6CC161B1A44305BBD724DF51CC81FA77378EB44708F10896EF246A62D0E7B8E9848B9D

Function 0036B480 Relevance: 66.9, APIs: 28, Strings: 10, Instructions: 363memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036B4A2

Part of subcall function 003673E0: memset.MSVCRT ref: 00367401
Part of subcall function 003673E0: memset.MSVCRT ref: 00367419
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 00367431
Part of subcall function 003673E0: _snprintf.MSVCRT ref: 00367449
Part of subcall function 003673E0: _vsnprintf.MSVCRT ref: 0036746B
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 0036747A

lstrcpyA.KERNEL32(?,00371335), ref: 0036B51A
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0036B536
GetVersionExA.KERNEL32(?), ref: 0036B550
lstrcpyA.KERNEL32(?,ERR), ref: 0036B5F5
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0036B60D
strstr.MSVCRT ref: 0036B641
lstrlenA.KERNEL32(00000000), ref: 0036B650
lstrlenA.KERNEL32(-00000004), ref: 0036B65F
GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0036B67D
lstrcmpA.KERNEL32(-00000004,00372BE4), ref: 0036B6A8
GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 0036B6C5
lstrcpyA.KERNEL32(?,00000000), ref: 0036B719
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0036B74A

Part of subcall function 00361BA0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00361BC5

HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0036B75B
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0036B76E
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 0036B781
_snprintf.MSVCRT ref: 0036B796
_snprintf.MSVCRT ref: 0036B7AB
lstrcpyA.KERNEL32(?,00372C0C), ref: 0036B7CD
_snprintf.MSVCRT ref: 0036B7FC
_snprintf.MSVCRT ref: 0036B863
_snprintf.MSVCRT ref: 0036B878
lstrcpyA.KERNEL32(?,00372C0C), ref: 0036B89A
_snprintf.MSVCRT ref: 0036B8C9
_snprintf.MSVCRT ref: 0036B8E0
??3@YAXPAX@Z.MSVCRT(?), ref: 0036B8F3

Strings

isadmin, xrefs: 0036B4A9
2K8, xrefs: 0036B5BD, 0036B5D9
, xrefs: 0036B63B
n%s[%s{%s%s{%s, xrefs: 0036B7F1, 0036B8BE
admin, xrefs: 0036B4AE
ERR, xrefs: 0036B5E4, 0036B5EC, 0036B68A, 0036B6CF, 0036B706
http://api.wipmania.com/, xrefs: 0036B620
VIS, xrefs: 0036B5B2
2K3, xrefs: 0036B593
[%s{%s%s{%s, xrefs: 0036B80B, 0036B8D5

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: _snprintf$AllocHeap$lstrcpy$lstrlen$memset$InfoLocaleTime$??3@FileSystemVersion_vsnprintflstrcmpstrstr
String ID: 2K3$2K8$ $ERR$VIS$[%s{%s%s{%s$admin$http://api.wipmania.com/$isadmin$n%s[%s{%s%s{%s
API String ID: 124843797-3058427118
Opcode ID: 38736b8b97e97289167f21de5f286e04aa3c963098bc85c7f20d7e79cd6cb2f5
Instruction ID: 46366e9af9fb6619ad18183ff048b9bfecb3083293a1614b67bec970f01eb473
Opcode Fuzzy Hash: 38736b8b97e97289167f21de5f286e04aa3c963098bc85c7f20d7e79cd6cb2f5
Instruction Fuzzy Hash: 08C173B1A40705ABD736DB94CC82EABB3BCAB54704F14C91CF346AB584D7B4E9848F61

Function 00401EA0 Relevance: 37.7, APIs: 25, Instructions: 195fileencryptionCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00401ECD
GetLastError.KERNEL32 ref: 00401EDA
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00401EF5
GetLastError.KERNEL32 ref: 00401EFF
CloseHandle.KERNEL32(00000000), ref: 00401F06

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLast$AcquireCloseContextCreateCryptFileHandle
String ID:
API String ID: 2213256293-0
Opcode ID: e4a31331d112a67bdcebc61a7cb6164f8bfe0d5aecb2f3aaefa7239b3fa62299
Instruction ID: 29da55e24c53a6960bedebd6ee296a713d47ef44fcd8d90534e508c4660d2c9c
Opcode Fuzzy Hash: e4a31331d112a67bdcebc61a7cb6164f8bfe0d5aecb2f3aaefa7239b3fa62299
Instruction Fuzzy Hash: B4517F76A00108BFDB109BE4EC88AFFBB7CEB49355F10856AFB05D2260D77589418B68

Function 00361EA0 Relevance: 37.7, APIs: 25, Instructions: 195fileencryptionCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00361ECD
GetLastError.KERNEL32 ref: 00361EDA
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00361EF5
GetLastError.KERNEL32 ref: 00361EFF
CloseHandle.KERNEL32(00000000), ref: 00361F06

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ErrorLast$AcquireCloseContextCreateCryptFileHandle
String ID:
API String ID: 2213256293-0
Opcode ID: ebc95cb986f6c52362ddbad91df948eed7d41a8fa27fc4a814110a9d9c953849
Instruction ID: 16ca4a358659dae24186af09ba0eb44380a43b38fe8e5e876fb44ca54a814f20
Opcode Fuzzy Hash: ebc95cb986f6c52362ddbad91df948eed7d41a8fa27fc4a814110a9d9c953849
Instruction Fuzzy Hash: A851B377A10108AFDB229FE9EC88EBFB77CFB48355F504599FA09D6240D73189818B60

Function 004053D0 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 258nativeinjectionmemoryCOMMON

Download Yara Rule

APIs

NtQueryInformationThread.NTDLL(?,00000000,?,0000001C,00000000), ref: 004053E7
OpenProcess.KERNEL32(0000047A,00000000,?), ref: 0040540E
NtQueryInformationProcess.NTDLL(00000000,0000001B,?,00000400,00000000), ref: 0040542F
CloseHandle.KERNEL32(00000000), ref: 004056C0

Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C

InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 004054AB
VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0040552F
WriteProcessMemory.KERNEL32 ref: 0040554E
NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 00405573
ReadProcessMemory.KERNEL32 ref: 004055A0
ReadProcessMemory.KERNEL32 ref: 004055C4
ReadProcessMemory.KERNEL32 ref: 004055EC
ReadProcessMemory.KERNEL32 ref: 00405618

Part of subcall function 00404160: VirtualAllocEx.KERNELBASE(?,00000000,00000000,00003000,00000040,00000000,?,?,?), ref: 00404192
Part of subcall function 00404160: WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0040424F

WriteProcessMemory.KERNEL32 ref: 004056B7

Strings

zC, xrefs: 00405673
STFU, xrefs: 00405467, 0040546A
zC, xrefs: 00405636

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Process$Memory$Read$InformationQueryWrite$AllocVirtual$CloseCompareExchangeHandleInterlockedMutexObjectOpenReleaseSingleThreadWait
String ID: STFU$zC$zC
API String ID: 992379172-23431524
Opcode ID: b939856e6fbf4f50ad2b13fa2647fb61fac06f8d783d1b4027c565cdf868c979
Instruction ID: df0844a3ba5e5749fd7180ba75f548f14b80aef18a41645c055a17c66c8f8887
Opcode Fuzzy Hash: b939856e6fbf4f50ad2b13fa2647fb61fac06f8d783d1b4027c565cdf868c979
Instruction Fuzzy Hash: F79173B5901209AFEB10DF94CC41FEF7778EB88704F10856AE605AB290E7759E41CF68

Function 003653D0 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 258nativeinjectionmemoryCOMMON

Download Yara Rule

APIs

NtQueryInformationThread.NTDLL(?,00000000,?,0000001C,00000000), ref: 003653E7
OpenProcess.KERNEL32(0000047A,00000000,?), ref: 0036540E
NtQueryInformationProcess.NTDLL(00000000,0000001B,?,00000400,00000000), ref: 0036542F
CloseHandle.KERNEL32(00000000), ref: 003656C0

Part of subcall function 00364900: WaitForSingleObject.KERNEL32(00367495,000000FF,?,00000000,756F59EB,?,00367495), ref: 00364939
Part of subcall function 00364900: ReleaseMutex.KERNEL32(?,?,00367495), ref: 0036497C

InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 003654AB
VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0036552F
WriteProcessMemory.KERNEL32 ref: 0036554E
NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 00365573
ReadProcessMemory.KERNEL32 ref: 003655A0
ReadProcessMemory.KERNEL32 ref: 003655C4
ReadProcessMemory.KERNEL32 ref: 003655EC
ReadProcessMemory.KERNEL32 ref: 00365618

Part of subcall function 00364160: VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040,00000000,?,?,?), ref: 00364192
Part of subcall function 00364160: WriteProcessMemory.KERNEL32 ref: 0036424F

WriteProcessMemory.KERNEL32 ref: 003656B7

Strings

z9, xrefs: 00365636
z9, xrefs: 00365673
STFU, xrefs: 00365467, 0036546A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Process$Memory$Read$InformationQueryWrite$AllocVirtual$CloseCompareExchangeHandleInterlockedMutexObjectOpenReleaseSingleThreadWait
String ID: STFU$z9$z9
API String ID: 992379172-4188904995
Opcode ID: b31939b989d118f630154e38c5391a898e8452d8c6b09e3eca08971324e6bc2f
Instruction ID: 9bc167182ce3e140ad545d3d5124f44752b8c29802b6adb94a676814882d6c75
Opcode Fuzzy Hash: b31939b989d118f630154e38c5391a898e8452d8c6b09e3eca08971324e6bc2f
Instruction Fuzzy Hash: 5F9170B5A01609AFDB11DF94CC81FEE77BCEB84700F508169E605AB284EB749E41CBA4

Function 0040F130 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F150
memset.MSVCRT ref: 0040F168
lstrcpyA.KERNEL32(?,?), ref: 0040F17B

Part of subcall function 0040EDF0: memset.MSVCRT ref: 0040EE0E
Part of subcall function 0040EDF0: vsprintf.MSVCRT ref: 0040EE22
Part of subcall function 0040EDF0: PathAppendA.SHLWAPI(?,00000000), ref: 0040EE35

SetCurrentDirectoryA.KERNEL32(?), ref: 0040F196
FindFirstFileA.KERNEL32(?,?), ref: 0040F1AA
CoInitialize.OLE32(00000000), ref: 0040F1C2
_snprintf.MSVCRT ref: 0040F1E1
FindNextFileA.KERNEL32(?,?), ref: 0040F20C
strncmp.MSVCRT ref: 0040F22E
strstr.MSVCRT ref: 0040F246
_snprintf.MSVCRT ref: 0040F26B
FindNextFileA.KERNEL32(?,?), ref: 0040F290
FindClose.KERNEL32(?), ref: 0040F29E

Strings

%s%s, xrefs: 0040F1D0, 0040F25A
RECYCLED, xrefs: 0040F228
.inf, xrefs: 0040F240

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Find$Filememset$Next_snprintf$AppendCloseCurrentDirectoryFirstInitializePathlstrcpystrncmpstrstrvsprintf
String ID: %s%s$.inf$RECYCLED
API String ID: 3870971729-188919753
Opcode ID: bd566a15def4f28c764169d26c68d832e88d6b2d9000b55ba9adc75dc1e1f3fb
Instruction ID: 063b9b5624f3e53f2b7c9015ed89a51c60917bf55f536b871253b52f4a03b6c8
Opcode Fuzzy Hash: bd566a15def4f28c764169d26c68d832e88d6b2d9000b55ba9adc75dc1e1f3fb
Instruction Fuzzy Hash: 7941A57594021CABCB20DB61DC85FEB777CEB58304F0445AAF908A2190E6B5AFC5CB64

Function 0036F130 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036F150
memset.MSVCRT ref: 0036F168
lstrcpyA.KERNEL32(?,?), ref: 0036F17B

Part of subcall function 0036EDF0: memset.MSVCRT ref: 0036EE0E
Part of subcall function 0036EDF0: vsprintf.MSVCRT ref: 0036EE22
Part of subcall function 0036EDF0: PathAppendA.SHLWAPI(?,00000000), ref: 0036EE35

SetCurrentDirectoryA.KERNEL32(?), ref: 0036F196
FindFirstFileA.KERNEL32(?,?), ref: 0036F1AA
CoInitialize.OLE32(00000000), ref: 0036F1C2
_snprintf.MSVCRT ref: 0036F1E1
FindNextFileA.KERNEL32(?,?), ref: 0036F20C
strncmp.MSVCRT ref: 0036F22E
strstr.MSVCRT ref: 0036F246
_snprintf.MSVCRT ref: 0036F26B
FindNextFileA.KERNEL32(?,?), ref: 0036F290
FindClose.KERNEL32(?), ref: 0036F29E

Strings

.inf, xrefs: 0036F240
%s%s, xrefs: 0036F1D0, 0036F25A
RECYCLED, xrefs: 0036F228

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Find$Filememset$Next_snprintf$AppendCloseCurrentDirectoryFirstInitializePathlstrcpystrncmpstrstrvsprintf
String ID: %s%s$.inf$RECYCLED
API String ID: 3870971729-188919753
Opcode ID: 7e7288f2f41a7029df25e8dec6f25fd5dd6afa16d558c9c312024b01c87ef185
Instruction ID: 046483317ee98d768293d9f4e58b829688ab387bf3925eaa1bb6bb150d169b95
Opcode Fuzzy Hash: 7e7288f2f41a7029df25e8dec6f25fd5dd6afa16d558c9c312024b01c87ef185
Instruction Fuzzy Hash: A94183BA94021CABCB26DB64DC85EEB737CEB54300F048598F90CA6144E674AFC5CB60

Function 0036AA10 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157networkstringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036AA31
lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0036AA45
InternetOpenA.WININET(00000000,?,?,?,?), ref: 0036AA60
lstrlenA.KERNEL32(?), ref: 0036AA78
InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0036AA8C
HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 0036AAC0
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 0036AAE2
??2@YAPAXI@Z.MSVCRT ref: 0036AB15
InternetReadFile.WININET(00000000,?,00000FF8,00000001), ref: 0036AB67
??2@YAPAXI@Z.MSVCRT ref: 0036AB85
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0036ABA5
InternetCloseHandle.WININET(00000000), ref: 0036ABE7

Strings

Mozilla/4.0, xrefs: 0036AA39

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Internet$??2@OpenQuery$??3@AvailableCloseDataFileHandleHttpInfoReadlstrcpylstrlenmemset
String ID: Mozilla/4.0
API String ID: 2392773942-2634101963
Opcode ID: 59a30469ff1b8a69c1d33479d52b0dc1ceaef956b2935f41006aaca7caf68cbc
Instruction ID: ed71d7344c77238ad16aa33d4479489d6ec062e9d8c778bd7f6dbcde569ff9df
Opcode Fuzzy Hash: 59a30469ff1b8a69c1d33479d52b0dc1ceaef956b2935f41006aaca7caf68cbc
Instruction Fuzzy Hash: 86519E71A00245AFD722CF59DC84FAABBFCEB49300F04856DE909E7252D7789944CF61

Function 0036EE40 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142stringcomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00373634,00000000,00000001,00373614,?), ref: 0036EE5B
memset.MSVCRT ref: 0036EE81
lstrcpyA.KERNEL32(00000000,?), ref: 0036EE9A
lstrcatA.KERNEL32(00000000,00372C78), ref: 0036EEAE
lstrcatA.KERNEL32(00000000,?), ref: 0036EEBB
memset.MSVCRT ref: 0036EED5
SHGetFileInfoA.SHELL32(?,00000000,00000000,00000160,00001000), ref: 0036EEF4
memset.MSVCRT ref: 0036EF68
lstrcpyA.KERNEL32(00000000,?), ref: 0036EF7B
lstrcatA.KERNEL32(00000000,.lnk), ref: 0036EF89
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0036EFA4

Strings

.lnk, xrefs: 0036EF7D
shell32.dll, xrefs: 0036EF25

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrcatmemset$lstrcpy$ByteCharCreateFileInfoInstanceMultiWide
String ID: .lnk$shell32.dll
API String ID: 3196525290-3399515747
Opcode ID: db6c8e19bf646293cd08de28edbb93c97b761b5d25908a74eea31520765f6a71
Instruction ID: 990005829e6998115e4d84a27ef0e59086f6ae7bfac225a48b914291dd2b1715
Opcode Fuzzy Hash: db6c8e19bf646293cd08de28edbb93c97b761b5d25908a74eea31520765f6a71
Instruction Fuzzy Hash: EE512675A40218AFDB65DB94CC85FDAB3BDAF8C700F104588F608EB290D7B5AE45CB64

Function 0036E880 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84pipestringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036E8A0
lstrlenA.KERNEL32(30e44aa1), ref: 0036E8AD
_snprintf.MSVCRT ref: 0036E8D0
CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0036E8FF
ConnectNamedPipe.KERNEL32(00000000,00000000), ref: 0036E913
GetLastError.KERNEL32 ref: 0036E91D
CreateThread.KERNEL32(00000000,00000000,Function_0000D7A0,00000000,00000000,00000000), ref: 0036E941
CloseHandle.KERNEL32(00000000), ref: 0036E94B
CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0036E96E

Strings

30e44aa1, xrefs: 0036E8A8, 0036E8B4
\\.\pipe\%08x_ipc, xrefs: 0036E8BF

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CreateNamedPipe$CloseConnectErrorHandleLastThread_snprintflstrlenmemset
String ID: 30e44aa1$\\.\pipe\%08x_ipc
API String ID: 4065143564-1096776489
Opcode ID: d31acad39b633b431e1d10d34496e352472ea88846224be7f597e5883e3d1777
Instruction ID: 3cd32a5123ed202efaf8f5eafe7f4d40d98fae2e8a028a133d9cdaca75320ebf
Opcode Fuzzy Hash: d31acad39b633b431e1d10d34496e352472ea88846224be7f597e5883e3d1777
Instruction Fuzzy Hash: C82105767C03157AF33266784C87FAA765CAF14F21F648560FB08FD0C0DAF4694446A9

Function 00405820 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 171nativesleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405844
CloseHandle.KERNEL32(00000000), ref: 004058B9
NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 004058CF
NtQueryInformationProcess.NTDLL(00000000,0000001B,00000000,00000800,00000000), ref: 004058FC
InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 00405970
CloseHandle.KERNEL32(00000000), ref: 00405A05

Part of subcall function 004049F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,004073CC,00437C98,00000000,00000000,00000010,00000000), ref: 00404A10
Part of subcall function 004049F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00404A77

Sleep.KERNEL32(00000001), ref: 004059F9

Strings

.`@, xrefs: 004059A7, 004059AC
(mA, xrefs: 0040582A
STFU, xrefs: 00405933, 00405936

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CloseHandleInformationProcessQuery$CompareExchangeInterlockedMutexObjectReleaseSingleSleepWaitmemset
String ID: (mA$.`@$STFU
API String ID: 1902471319-61987734
Opcode ID: bca6671e6a5d14b828f609e28b7a034000451f6025cb8f49a12631a468eaa51f
Instruction ID: 732b757521710307399e601c09f1fe9508d0a5d5828f33180c83336337d0604a
Opcode Fuzzy Hash: bca6671e6a5d14b828f609e28b7a034000451f6025cb8f49a12631a468eaa51f
Instruction Fuzzy Hash: 4451A3B0A40215ABDB14DFA9CC45BAF77B8EB84710F14817AF945F62C0DB789E40CBA4

Function 00365820 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 171nativesleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00365844
CloseHandle.KERNEL32(00000000), ref: 003658B9
NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 003658CF
NtQueryInformationProcess.NTDLL(00000000,0000001B,00000000,00000800,00000000), ref: 003658FC
InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 00365970
CloseHandle.KERNEL32(00000000), ref: 00365A05

Part of subcall function 003649F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,003673CC,00397C98,00000000,00000000,00000010,00000000), ref: 00364A10
Part of subcall function 003649F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00364A77

Sleep.KERNEL32(00000001), ref: 003659F9

Strings

STFU, xrefs: 00365933, 00365936
.`6, xrefs: 003659A7, 003659AC
(m7, xrefs: 0036582A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CloseHandleInformationProcessQuery$CompareExchangeInterlockedMutexObjectReleaseSingleSleepWaitmemset
String ID: (m7$.`6$STFU
API String ID: 1902471319-631095445
Opcode ID: 4135884fef37409fd97a8a00bf0f7ff8d3bd10d3f368d99827e806ae55bec7cd
Instruction ID: 0f7a50d8f918aeb4a50ac4b3a10e812c7c1af9caaad87b520788980438a94397
Opcode Fuzzy Hash: 4135884fef37409fd97a8a00bf0f7ff8d3bd10d3f368d99827e806ae55bec7cd
Instruction Fuzzy Hash: 4951C571E00615ABDB25DFA8CC45BAE77F8EB84710F14C169F949EB284EB749E40CB90

Function 00409D90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000004), ref: 00409DA7
CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,20000080,00000000), ref: 00409DD5

Strings

\\.\PHYSICALDRIVE0, xrefs: 00409DD0

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: AllocCreateFileVirtual
String ID: \\.\PHYSICALDRIVE0
API String ID: 1475775534-1557481562
Opcode ID: ffcd8f6330cbc774a61a6af0c0f4be1ea2cb921640cac86a5a12dedcfbeb7a29
Instruction ID: d500eae6f82fa0b336e9878c8502f6def019f67c4d7c2b81654dcf0d8b160c7b
Opcode Fuzzy Hash: ffcd8f6330cbc774a61a6af0c0f4be1ea2cb921640cac86a5a12dedcfbeb7a29
Instruction Fuzzy Hash: D931B87278030876F62056A9AC46FEB775CD788B32F204262FB08F91D1DAB06D4486F8

Function 00369D90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000004), ref: 00369DA7
CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,20000080,00000000), ref: 00369DD5

Strings

\\.\PHYSICALDRIVE0, xrefs: 00369DD0

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: AllocCreateFileVirtual
String ID: \\.\PHYSICALDRIVE0
API String ID: 1475775534-1557481562
Opcode ID: 8544bddec7bbd1bf05691a612eb7f58ae6884075bc8c938427130882b6f8af4b
Instruction ID: ba6f11b481e78d2c9b2800576740bcc79d0d2aaa5ec40241a11d2659241b1f46
Opcode Fuzzy Hash: 8544bddec7bbd1bf05691a612eb7f58ae6884075bc8c938427130882b6f8af4b
Instruction Fuzzy Hash: 3531B8727803047AF63156ADAC47FEB775CD784B32F204262FB08E91C0DAA1694487F4

Function 00409EC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409EDF
CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00409F16
DeviceIoControl.KERNEL32(00000000,00090018,00000000,00000000,00000000,00000000,?,00000000), ref: 00409F45
WriteFile.KERNEL32(00000000,00000000,00000200,?,00000000), ref: 00409F5A
DeviceIoControl.KERNEL32(00000000,0009001C,00000000,00000000,00000000,00000000,?,00000000), ref: 00409F74
CloseHandle.KERNEL32(00000000), ref: 00409F77

Strings

\\.\PHYSICALDRIVE0, xrefs: 00409F09
U, xrefs: 00409F0E
00100, xrefs: 00409EEC

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ControlDeviceFile$CloseCreateHandleWritememset
String ID: 00100$U$\\.\PHYSICALDRIVE0
API String ID: 3939175881-3482488017
Opcode ID: d4a1ed7fe161a1ca99d4ffb7099c3cc08b8e683dc24901a62f0134f85c4f11e7
Instruction ID: c1763296a4acec64689325a2958d955e7f70efc6b3c63e6c8c8dbaef50afdc01
Opcode Fuzzy Hash: d4a1ed7fe161a1ca99d4ffb7099c3cc08b8e683dc24901a62f0134f85c4f11e7
Instruction Fuzzy Hash: DE11B631BC03187AF730A7649C0BFDAB66C8B59B11F100295F714BA1D1DAE42B4087A9

Function 00369EC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00369EDF
CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00369F16
DeviceIoControl.KERNEL32(00000000,00090018,00000000,00000000,00000000,00000000,?,00000000), ref: 00369F45
WriteFile.KERNEL32(00000000,00000000,00000200,?,00000000), ref: 00369F5A
DeviceIoControl.KERNEL32(00000000,0009001C,00000000,00000000,00000000,00000000,?,00000000), ref: 00369F74
CloseHandle.KERNEL32(00000000), ref: 00369F77

Strings

U, xrefs: 00369F0E
\\.\PHYSICALDRIVE0, xrefs: 00369F09
00100, xrefs: 00369EEC

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ControlDeviceFile$CloseCreateHandleWritememset
String ID: 00100$U$\\.\PHYSICALDRIVE0
API String ID: 3939175881-3482488017
Opcode ID: 53c87afece4fbe33683d82a1043323a21df8b336b82f9fa005b11470bf058a46
Instruction ID: 4c22e62fc13232181ed20a646a192a88c91a9dbbae1acf0ab315a7b964c73e9f
Opcode Fuzzy Hash: 53c87afece4fbe33683d82a1043323a21df8b336b82f9fa005b11470bf058a46
Instruction Fuzzy Hash: 8E11E732BD03187AF731E6A89C0BFDA776C8B55F11F104280F718BE1C19AE0274087A9

Function 00403440 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 136memorynativeCOMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 004034A0
printf.MSVCRT ref: 004034AD
printf.MSVCRT ref: 004034CC
NtAllocateVirtualMemory.NTDLL(00000000,?,00000000,00437A80,00003000,00000040), ref: 004034F2

Strings

Done frst, xrefs: 004034C7
block_size: %d, xrefs: 00403498
ngr->blocksize: %d, xrefs: 004034A8

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: printf$AllocateMemoryVirtual
String ID: Done frst$block_size: %d$ngr->blocksize: %d
API String ID: 3635587295-1816125109
Opcode ID: 97c15441b68f69641c94349759af36be741f732a192bd59ec89c2944423630dc
Instruction ID: a515e188e62a96647e9cbe95b5ca16a3a4a6047310d6757b3ddcde311f3628c1
Opcode Fuzzy Hash: 97c15441b68f69641c94349759af36be741f732a192bd59ec89c2944423630dc
Instruction Fuzzy Hash: 0941F571A00204ABCB14DF59CC45E9A7BADEF84329F14856FF9099B391E638EE41CB94

Function 00363440 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 136memorynativeCOMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 003634A0
printf.MSVCRT ref: 003634AD
printf.MSVCRT ref: 003634CC
NtAllocateVirtualMemory.NTDLL(00000000,?,00000000,00397A80,00003000,00000040), ref: 003634F2

Strings

ngr->blocksize: %d, xrefs: 003634A8
Done frst, xrefs: 003634C7
block_size: %d, xrefs: 00363498

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: printf$AllocateMemoryVirtual
String ID: Done frst$block_size: %d$ngr->blocksize: %d
API String ID: 3635587295-1816125109
Opcode ID: 05ca3ff0ed4bcba6f8f49bcff08588da3d11a9856301168d07a0f9e808161f77
Instruction ID: 8fab25400cc0c5132a58c3f167d075cc290fe7108d36398906e43025aae408bc
Opcode Fuzzy Hash: 05ca3ff0ed4bcba6f8f49bcff08588da3d11a9856301168d07a0f9e808161f77
Instruction Fuzzy Hash: D9410575A00204AFCB16DF69C846E9AB7A9EF84324F14C55DF90D8B249EB35EF01CB90

Function 0040A550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00403920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 00403962

Part of subcall function 00403750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 0040376B

OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,ntdll.dll,NtShutdownSystem), ref: 0040A57A
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040A58F
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0040A5B3
GetLastError.KERNEL32 ref: 0040A5B9

Strings

ntdll.dll, xrefs: 0040A55C
NtShutdownSystem, xrefs: 0040A557
SeShutdownPrivilege, xrefs: 0040A588

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: StringToken$AddressAdjustAnsiErrorLastLookupOpenPrivilegePrivilegesProcedureProcessUnicodeValue
String ID: NtShutdownSystem$SeShutdownPrivilege$ntdll.dll
API String ID: 4135695518-1699316426
Opcode ID: c995f3c1d0a724f36528810c0480acc16cd25410b87a2cccc31b0e10fa1897df
Instruction ID: 41268f7d111cdba9b222163e3203631acf71579276c4fa84ae79774109ae6c2c
Opcode Fuzzy Hash: c995f3c1d0a724f36528810c0480acc16cd25410b87a2cccc31b0e10fa1897df
Instruction Fuzzy Hash: EFF08675E403047BD710EBE59D0AFEF7BAC9B08705F104026B604F61D1DAF46A448BA9

Function 0036A550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00363920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 00363962

Part of subcall function 00363750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 0036376B

OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,ntdll.dll,NtShutdownSystem), ref: 0036A57A
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0036A58F
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0036A5B3
GetLastError.KERNEL32 ref: 0036A5B9

Strings

SeShutdownPrivilege, xrefs: 0036A588
ntdll.dll, xrefs: 0036A55C
NtShutdownSystem, xrefs: 0036A557

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: StringToken$AddressAdjustAnsiErrorLastLookupOpenPrivilegePrivilegesProcedureProcessUnicodeValue
String ID: NtShutdownSystem$SeShutdownPrivilege$ntdll.dll
API String ID: 4135695518-1699316426
Opcode ID: 350b54479aa84f554cd6323ba044ac2d77b64063104259ca8f6593464f6c12d5
Instruction ID: 773b607be1bb5ac7de4fee39e4e002afb8d01efc9d35bd2824981dd6eb46e3da
Opcode Fuzzy Hash: 350b54479aa84f554cd6323ba044ac2d77b64063104259ca8f6593464f6c12d5
Instruction Fuzzy Hash: D2F0A476A403047BE721EBE89C0BFEF77AC9B04B00F108004F609FA1C5DEB06A448BA1

Function 00364C20 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(00000000,00000028,?,00364E7E,SeDebugPrivilege,00000001,00000000,ntdll.dll,NtGetNextProcess), ref: 00364C32
GetLastError.KERNEL32 ref: 00364C3C
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00364C52
GetLastError.KERNEL32 ref: 00364C5C
CloseHandle.KERNEL32(?), ref: 00364C66

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ErrorLast$CloseHandleLookupOpenPrivilegeProcessTokenValue
String ID:
API String ID: 1673749002-0
Opcode ID: bab72ac6c93dfc6c1d4ce536cb2640832666144c0450ba6632b5312c280833c5
Instruction ID: 86aa566cee1c97aa597bef922b533b604b9e90c8c93a1de2fa20620043c5b14d
Opcode Fuzzy Hash: bab72ac6c93dfc6c1d4ce536cb2640832666144c0450ba6632b5312c280833c5
Instruction Fuzzy Hash: 3E118676A10208ABDB21DFE8DD0DFAEB7BCEB49701F404549FE0DD7240EA71994487A1

Function 003642E0 Relevance: 10.6, APIs: 7, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b93125eba8910506b40e9ba5b4385cef48a0e054bcb804f68244df297e9a45
Instruction ID: 942ce6274c200554a49d74525d88e97118f562e65eab34f5e31120a6708bfbdc
Opcode Fuzzy Hash: c8b93125eba8910506b40e9ba5b4385cef48a0e054bcb804f68244df297e9a45
Instruction Fuzzy Hash: EB31A475B003046BD7329F6AEC41F6BB3ADEB80711F258559FD09D7384EA71EC1086A0

Function 003656E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 00365741
NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 0036578B

Strings

(m7, xrefs: 00365795

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: InformationQuerySystem
String ID: (m7
API String ID: 3562636166-2716958383
Opcode ID: c86ca335198586971830259d0150735b7467204357c4a947286d54eb30c6aacb
Instruction ID: 6a7b06e9c0514afae4573d3a2dba231199cec1e3188b114992121cb2529e51ac
Opcode Fuzzy Hash: c86ca335198586971830259d0150735b7467204357c4a947286d54eb30c6aacb
Instruction Fuzzy Hash: C0416E75A00619ABDB21CFA4DC81FBEB3B8EB88704F158568E905E7244E774ED50CBA0

Function 00408C90 Relevance: 4.8, APIs: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408CBE

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: c0089952ace360ebcc3e34eb2580965971ac3f93c53b4d4a5c5986bf46cea3ca
Instruction ID: febdc5ac0e38d1c8f41d274fc77bf47f9808ab6730b1dfa3b6492b89c998bcbc
Opcode Fuzzy Hash: c0089952ace360ebcc3e34eb2580965971ac3f93c53b4d4a5c5986bf46cea3ca
Instruction Fuzzy Hash: A9A17FB19006059FCB20DF65CA8086FB7B9FF94314B10853FE586E7780DB38E9418B95

Function 00368C90 Relevance: 4.8, APIs: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00368CBE

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: c0089952ace360ebcc3e34eb2580965971ac3f93c53b4d4a5c5986bf46cea3ca
Instruction ID: 3b1c0084b12f256ce239e1f2dbe37b5a54488aa8cc27bd0b4d39ea97744b4ec9
Opcode Fuzzy Hash: c0089952ace360ebcc3e34eb2580965971ac3f93c53b4d4a5c5986bf46cea3ca
Instruction Fuzzy Hash: D8A18EB19006059FCB22DFA5D9C086FB7F9FF98314B11CA6EE5469B608DB31E901CB61

Function 0036F9E0 Relevance: 4.6, APIs: 3, Instructions: 65stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036F9FF
GetLogicalDriveStringsA.KERNEL32 ref: 0036FA22
lstrcatA.KERNEL32(00000000,00373040), ref: 0036FA5C

Part of subcall function 0036F430: memset.MSVCRT ref: 0036F459
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F472
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F48B
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F4A4
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F4BD
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F4D6
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F4F2
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F50B
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F526
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F541
Part of subcall function 0036F430: memset.MSVCRT ref: 0036F55C
Part of subcall function 0036F430: sprintf.MSVCRT ref: 0036F571
Part of subcall function 0036F430: sprintf.MSVCRT ref: 0036F586
Part of subcall function 0036F430: wsprintfW.USER32 ref: 0036F5A4

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: memset$sprintf$DriveLogicalStringslstrcatwsprintf
String ID:
API String ID: 563256260-0
Opcode ID: 8ea4098c29b3b19f6c80006f22f617f2e99f747f93eb6427672a10c4c5a6d508
Instruction ID: 6bda8b0900d93b91daff48e03b3481886123affa712e9759098cd1d3ea3897d8
Opcode Fuzzy Hash: 8ea4098c29b3b19f6c80006f22f617f2e99f747f93eb6427672a10c4c5a6d508
Instruction Fuzzy Hash: F3115EB5901349AEDB22DBB4EC41FEAB7789F14304F0480B9E94CA7146E5B05B0DCB61

Function 00408B30 Relevance: 3.1, APIs: 2, Instructions: 129windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408B6E
EncryptMessage.SECUR32(?,00000000,?,00000000,?,?,?), ref: 00408C29

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: EncryptMessagememset
String ID:
API String ID: 3924230039-0
Opcode ID: e2ab3e0427d67a117949027b41559f788fb6a7f02857e0614c7bc85d79e661e5
Instruction ID: 187c4bea0345dcc81a1e91117d9d58187b68109648b59adc59adcf4ae98d03d5
Opcode Fuzzy Hash: e2ab3e0427d67a117949027b41559f788fb6a7f02857e0614c7bc85d79e661e5
Instruction Fuzzy Hash: 5D410BB1D01208EFCB50CFA9D981ADEBBF5EF88314F14852EE849E7341D774AA458B94

Function 00368B30 Relevance: 3.1, APIs: 2, Instructions: 129windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00368B6E
EncryptMessage.SECUR32(?,00000000,?,00000000,?,?,?), ref: 00368C29

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: EncryptMessagememset
String ID:
API String ID: 3924230039-0
Opcode ID: e2ab3e0427d67a117949027b41559f788fb6a7f02857e0614c7bc85d79e661e5
Instruction ID: b61f3d4e1aedb6f2827acecde45dbe0953f7d338cc181ab8d833437bb09d93ae
Opcode Fuzzy Hash: e2ab3e0427d67a117949027b41559f788fb6a7f02857e0614c7bc85d79e661e5
Instruction Fuzzy Hash: E8411EB1D01208EFCB11CFA9D981ADEBBF5FF88314F14852AE849E7204D770AA45CB90

Function 00369E7B Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,?,00008000,?,00000000), ref: 00369E8D
DeviceIoControl.KERNEL32(00000000,0009001C,00000000,00000000,00000000,00000000,?,00000000), ref: 00369EA2

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ControlDeviceFileWrite
String ID:
API String ID: 564257829-0
Opcode ID: 8a8d713ac8bbe28bcd855ce0ac5e891d2b9d2a39c4c4b13159d5c3b48d242ba3
Instruction ID: e2080bde2903acd5c0182994c92314af4119ce9e7050c601c551be7b812557b5
Opcode Fuzzy Hash: 8a8d713ac8bbe28bcd855ce0ac5e891d2b9d2a39c4c4b13159d5c3b48d242ba3
Instruction Fuzzy Hash: EFE0C2F2210108BDF620C2949D81FFB371CD784711F100193FD09D0080D961AD4497B0

Function 00363830 Relevance: 2.5, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,?,00362D43,?,00000100,?,(m7,?,?,00365730,?,00008000,?,00000000), ref: 0036384F
HeapReAlloc.KERNEL32(00000000,?,00362D43,?,00000100,?,(m7,?,?,00365730,?,00008000,?,00000000,00000000,?), ref: 00363856

Part of subcall function 00363810: GetProcessHeap.KERNEL32(00000000,00000000,?,00364046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00363819
Part of subcall function 00363810: HeapAlloc.KERNEL32(00000000,?,00364046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00363820

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f8359e7331deb651205373da72dfd739c5a8e68fdb34e468dec3666a4957e540
Instruction ID: 2625e6aabad2cf0ab874c2cfe11ec0a241e65037edebf17b23120b3c1ad8e8b2
Opcode Fuzzy Hash: f8359e7331deb651205373da72dfd739c5a8e68fdb34e468dec3666a4957e540
Instruction Fuzzy Hash: F1D012B65002086BEB019BA4EC49EAA375C9B04714F448014FA0D8B501D631E9508761

Function 00361AD0 Relevance: 1.6, APIs: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00361AE9

Part of subcall function 00361A10: CreateFileW.KERNEL32(?,00000100,00000001,00000000,00000003,?,00000000), ref: 00361A36
Part of subcall function 00361A10: SetFileTime.KERNEL32(00000000,?,?,?), ref: 00361A50
Part of subcall function 00361A10: CloseHandle.KERNEL32(00000000), ref: 00361A59

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: FileTime$CloseCreateHandleSystem
String ID:
API String ID: 489727163-0
Opcode ID: b2e14b774be4cd6c293cc0c603382b1b9a3438024ae1840398883401c2ed36ca
Instruction ID: 57f4263df51c766d937934ddecf4d5785fa10fb2a9ff2bbebd84f47e4d3221d8
Opcode Fuzzy Hash: b2e14b774be4cd6c293cc0c603382b1b9a3438024ae1840398883401c2ed36ca
Instruction Fuzzy Hash: 0911DEB6D10228BBCB05EFD4DC81EEEB77CAB58B00F04854AB615E7145E670A704CBA5

Function 00402D60 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ab7da85d1484886710da23cc53855dd25be7a8e112030da8bc2f05dc99f62e
Instruction ID: 219b0fc98e8f073de552917feaf8e62aac511575ba6e78677fee7b87815c9be5
Opcode Fuzzy Hash: 74ab7da85d1484886710da23cc53855dd25be7a8e112030da8bc2f05dc99f62e
Instruction Fuzzy Hash: BA014F322B5D0E49C75E451C1A2CABB12020F56B597D4463A4AC2F07D4EDFEEC43D08D

Function 00362D60 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c71bca018e55767288fbc09d243066027f6e76293dfe47211a1aefeaf2a69d
Instruction ID: a524b2347caae6757859291ebfb8d3e984afe2170a5e06bc67021da95be79e99
Opcode Fuzzy Hash: 82c71bca018e55767288fbc09d243066027f6e76293dfe47211a1aefeaf2a69d
Instruction Fuzzy Hash: 500112722B5D0E48C75F451C4814ABB12094F56B96B97C6389EE2D47ECDDDAEC43D084

Function 0040D7A0 Relevance: 154.5, APIs: 54, Strings: 34, Instructions: 473memorystringfileCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,00000008,00000800), ref: 0040D7C3
HeapAlloc.KERNEL32(?,00000008,00000800), ref: 0040D7D2
memset.MSVCRT ref: 0040D7EE
HeapFree.KERNEL32(?,?,00000000), ref: 0040D80B
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040D819
GetLastError.KERNEL32 ref: 0040D82F
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040D83C
GetLastError.KERNEL32 ref: 0040D852
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040D85B
ReadFile.KERNEL32(?,00000000,00000800,00000000,00000000), ref: 0040D87A
atoi.MSVCRT(00000000), ref: 0040D8D3
strchr.MSVCRT ref: 0040D8E8
lstrlenA.KERNEL32(30e44aa1), ref: 0040D900
HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0040D924
HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0040D930
strchr.MSVCRT ref: 0040D93F
lstrlenA.KERNEL32(00000000), ref: 0040D952
lstrcpynA.KERNEL32(00000000,00000001,00000000), ref: 0040D95E
lstrcpynA.KERNEL32(?,00000000,00000001), ref: 0040D96D
lstrcmpA.KERNEL32(?,ftplog), ref: 0040D97F

Strings

[Ruskill]: Detected DNS: "%s", xrefs: 0040DB62
ftpinfect, xrefs: 0040DA58
[FTP Infect]: %s was iframed, xrefs: 0040DA6B
httpspread, xrefs: 0040DC46
disable, xrefs: 0040DB1B
ruskill, xrefs: 0040DB0F
[MSN]: %s, xrefs: 0040DC0A
30e44aa1, xrefs: 0040D8FA, 0040D908
poplog, xrefs: 0040D9E8
[DNS]: Blocked DNS "%s", xrefs: 0040DBE2
msn, xrefs: 0040DBF7
dns, xrefs: 0040DBD0
0WA, xrefs: 0040DABA
[PDef+]: %s, xrefs: 0040DBB8
ftplog, xrefs: 0040D979
[Ruskill]: Detected Reg: "%s", xrefs: 0040DB8D
httplogin, xrefs: 0040DAAE
block, xrefs: 0040DC37
[Ruskill]: Detected File: "%s", xrefs: 0040DB38
[POP3 Login]: %s, xrefs: 0040D9FB
rreg, xrefs: 0040DB7A
httptraff, xrefs: 0040DA83
[HTTP]: %s, xrefs: 0040DC59
4WA, xrefs: 0040DBB1
[HTTP Login]: %s, xrefs: 0040DAC0
@WA, xrefs: 0040DC03, 0040DC52
8WA, xrefs: 0040DB31, 0040DB5C, 0040DB86
[HTTP Traffic]: %s, xrefs: 0040DA96
[FTP Login]: %s, xrefs: 0040D98B
blk, xrefs: 0040DC25
<WA, xrefs: 0040D985, 0040D9F4
rdns, xrefs: 0040DB50
POP3 -> , xrefs: 0040DA2B
FTP -> , xrefs: 0040D9BB

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$AllocFree$ErrorLastlstrcpynlstrlenstrchr$FileReadatoilstrcmpmemset
String ID: 0WA$30e44aa1$4WA$8WA$<WA$@WA$FTP -> $POP3 -> $[DNS]: Blocked DNS "%s"$[FTP Infect]: %s was iframed$[FTP Login]: %s$[HTTP Login]: %s$[HTTP Traffic]: %s$[HTTP]: %s$[MSN]: %s$[PDef+]: %s$[POP3 Login]: %s$[Ruskill]: Detected DNS: "%s"$[Ruskill]: Detected File: "%s"$[Ruskill]: Detected Reg: "%s"$blk$block$disable$dns$ftpinfect$ftplog$httplogin$httpspread$httptraff$msn$poplog$rdns$rreg$ruskill
API String ID: 1531277263-343948886
Opcode ID: 226946bfaaa6e499b063feb038c8fac31a3ab4f314e31c634eed55588fe6e7b0
Instruction ID: 93a879a63f9d5e1309c0a058911fb680e789185c1f282c53cedf1341369c8508
Opcode Fuzzy Hash: 226946bfaaa6e499b063feb038c8fac31a3ab4f314e31c634eed55588fe6e7b0
Instruction Fuzzy Hash: B2E12771A40604BBE71067A59C46FFF762CEF89705F21803AFA15B22D1DBB89D04C6AD

Function 0036D7A0 Relevance: 154.5, APIs: 54, Strings: 34, Instructions: 473memorystringfileCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,00000008,00000800), ref: 0036D7C3
HeapAlloc.KERNEL32(?,00000008,00000800), ref: 0036D7D2
memset.MSVCRT ref: 0036D7EE
HeapFree.KERNEL32(?,?,00000000), ref: 0036D80B
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036D819
GetLastError.KERNEL32 ref: 0036D82F
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036D83C
GetLastError.KERNEL32 ref: 0036D852
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036D85B
ReadFile.KERNEL32(?,00000000,00000800,00000000,00000000), ref: 0036D87A
atoi.MSVCRT(00000000), ref: 0036D8D3
strchr.MSVCRT ref: 0036D8E8
lstrlenA.KERNEL32(30e44aa1), ref: 0036D900
HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0036D924
HeapAlloc.KERNEL32(?,00000008,00000001), ref: 0036D930
strchr.MSVCRT ref: 0036D93F
lstrlenA.KERNEL32(00000000), ref: 0036D952
lstrcpynA.KERNEL32(00000000,00000001,00000000), ref: 0036D95E
lstrcpynA.KERNEL32(?,00000000,00000001), ref: 0036D96D
lstrcmpA.KERNEL32(?,ftplog), ref: 0036D97F

Strings

httpspread, xrefs: 0036DC46
@W7, xrefs: 0036DC03, 0036DC52
0W7, xrefs: 0036DABA
8W7, xrefs: 0036DB31, 0036DB5C, 0036DB86
poplog, xrefs: 0036D9E8
[POP3 Login]: %s, xrefs: 0036D9FB
[Ruskill]: Detected File: "%s", xrefs: 0036DB38
4W7, xrefs: 0036DBB1
FTP -> , xrefs: 0036D9BB
[Ruskill]: Detected Reg: "%s", xrefs: 0036DB8D
ruskill, xrefs: 0036DB0F
httptraff, xrefs: 0036DA83
block, xrefs: 0036DC37
[PDef+]: %s, xrefs: 0036DBB8
ftplog, xrefs: 0036D979
[DNS]: Blocked DNS "%s", xrefs: 0036DBE2
<W7, xrefs: 0036D985, 0036D9F4
[HTTP]: %s, xrefs: 0036DC59
30e44aa1, xrefs: 0036D8FA, 0036D908
[MSN]: %s, xrefs: 0036DC0A
blk, xrefs: 0036DC25
httplogin, xrefs: 0036DAAE
rreg, xrefs: 0036DB7A
[HTTP Login]: %s, xrefs: 0036DAC0
[FTP Login]: %s, xrefs: 0036D98B
disable, xrefs: 0036DB1B
[HTTP Traffic]: %s, xrefs: 0036DA96
rdns, xrefs: 0036DB50
POP3 -> , xrefs: 0036DA2B
msn, xrefs: 0036DBF7
[FTP Infect]: %s was iframed, xrefs: 0036DA6B
[Ruskill]: Detected DNS: "%s", xrefs: 0036DB62
ftpinfect, xrefs: 0036DA58
dns, xrefs: 0036DBD0

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$AllocFree$ErrorLastlstrcpynlstrlenstrchr$FileReadatoilstrcmpmemset
String ID: 0W7$30e44aa1$4W7$8W7$<W7$@W7$FTP -> $POP3 -> $[DNS]: Blocked DNS "%s"$[FTP Infect]: %s was iframed$[FTP Login]: %s$[HTTP Login]: %s$[HTTP Traffic]: %s$[HTTP]: %s$[MSN]: %s$[PDef+]: %s$[POP3 Login]: %s$[Ruskill]: Detected DNS: "%s"$[Ruskill]: Detected File: "%s"$[Ruskill]: Detected Reg: "%s"$blk$block$disable$dns$ftpinfect$ftplog$httplogin$httpspread$httptraff$msn$poplog$rdns$rreg$ruskill
API String ID: 1531277263-1300064085
Opcode ID: db6ba5268b1a73ff2f50484ae9ddc0366b6b19cda26393d09d526b6fd9997f64
Instruction ID: 68c2467bdba1e249cd07bffd2784bfbfdd79010f791feb64c3beef2f6a80a50e
Opcode Fuzzy Hash: db6ba5268b1a73ff2f50484ae9ddc0366b6b19cda26393d09d526b6fd9997f64
Instruction Fuzzy Hash: 50E13876B40605BBE7335BA89C4AFBF776CEF86700F51C004F909A6295DBA49C40DBA1

Function 00410430 Relevance: 112.3, APIs: 51, Strings: 13, Instructions: 334stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,756F59EB), ref: 00410446
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0041044C
HeapAlloc.KERNEL32(00000000), ref: 00410453
memset.MSVCRT ref: 0041048B
GetProcessHeap.KERNEL32 ref: 00410493
lstrcpyA.KERNEL32(00000000,?), ref: 004104A9
sscanf.MSVCRT ref: 004104C5
strstr.MSVCRT ref: 004104DC
lstrlenA.KERNEL32(00402780), ref: 004104F0
lstrlenA.KERNEL32(?), ref: 004104FA
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 00410505
strtok.MSVCRT ref: 0041051B
lstrcpyA.KERNEL32(00000000,00411335), ref: 00410534
_memicmp.MSVCRT ref: 00410557
lstrlenA.KERNEL32(00402780), ref: 00410567
_snprintf.MSVCRT ref: 0041057B
_memicmp.MSVCRT ref: 00410596
lstrcatA.KERNEL32(00000000,00000000), ref: 004105A7
lstrcatA.KERNEL32(00000000,00000000), ref: 004105F1
lstrcatA.KERNEL32(00000000,00412B84), ref: 004105F9
strtok.MSVCRT ref: 00410602
lstrcatA.KERNEL32(00000000,00000000), ref: 0041061C
lstrcatA.KERNEL32(00000000,), ref: 00410624
lstrcatA.KERNEL32(00000000,00402780), ref: 0041062B
lstrlenA.KERNEL32(00000000), ref: 0041062E
_snprintf.MSVCRT ref: 00410646
lstrlenA.KERNEL32(00000000), ref: 0041064F
lstrlenA.KERNEL32(?), ref: 0041065A
HeapAlloc.KERNEL32(?,00000008,00000040), ref: 00410667
_snprintf.MSVCRT ref: 00410688
sscanf.MSVCRT ref: 004106A0
strstr.MSVCRT ref: 004106B7
strstr.MSVCRT ref: 004106D2
lstrlenA.KERNEL32(00000000), ref: 004106E6
lstrlenA.KERNEL32(-00000002), ref: 004106F3
HeapAlloc.KERNEL32(?,00000008,?), ref: 004106FF
lstrlenA.KERNEL32(00000000), ref: 00410714
lstrlenA.KERNEL32(-00000002), ref: 00410721
lstrcpynA.KERNEL32(?,-00000002,?), ref: 0041072C
lstrlenA.KERNEL32(?), ref: 00410736
lstrlenA.KERNEL32(00402780), ref: 0041073E
HeapAlloc.KERNEL32(?,00000008,?), ref: 0041074B
lstrlenA.KERNEL32(?,?,00402780), ref: 00410761
lstrlenA.KERNEL32(00402780), ref: 0041076A
_snprintf.MSVCRT ref: 00410787
HeapFree.KERNEL32(?,00000000,00000000), ref: 0041079F
HeapFree.KERNEL32(?,00000000,?), ref: 004107AC
HeapFree.KERNEL32(?,00000000,00000000), ref: 004107B6

Strings

SDG %d, xrefs: 004104BF
, xrefs: 004105A9, 004105CE, 0041061E, 004106CC
MSG %d %1s, xrefs: 0041069A
SDG %d %d, xrefs: 00410635
Reliability: , xrefs: 004105B5
Content-Length: %d, xrefs: 0041056A
%s%s, xrefs: 00410680
SDG , xrefs: 00410543
X-MMS-IM-Format: , xrefs: 004104D6, 004105DA
From: , xrefs: 00410590
SDG , xrefs: 004104AF
Content-Length: , xrefs: 00410551
MSG %d %s %d%s%s, xrefs: 0041077F

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$Heap$lstrcat$Alloc$_snprintf$Freestrstr$Process_memicmplstrcpysscanfstrtok$lstrcpynmemset
String ID: $%s%s$Content-Length: $Content-Length: %d$From: $MSG %d %1s$MSG %d %s %d%s%s$Reliability: $SDG $SDG $SDG %d$SDG %d %d$X-MMS-IM-Format:
API String ID: 375969099-2909086048
Opcode ID: 37cc3c8f1d7efab5335082757353a03a82e25d8d8234addcd3faba9dbf623912
Instruction ID: f5f8fd790bcaf9c40db7213d0d9bd0d66c8d2255c156342998f8a5311ef5fb81
Opcode Fuzzy Hash: 37cc3c8f1d7efab5335082757353a03a82e25d8d8234addcd3faba9dbf623912
Instruction Fuzzy Hash: FCA158B1A40309BBDB10DBA58D85EFF777DEB48704F14455AFA14E3241DAB8DE808B68

Function 00370430 Relevance: 112.3, APIs: 51, Strings: 13, Instructions: 334stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,756F59EB), ref: 00370446
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0037044C
HeapAlloc.KERNEL32(00000000), ref: 00370453
memset.MSVCRT ref: 0037048B
GetProcessHeap.KERNEL32 ref: 00370493
lstrcpyA.KERNEL32(00000000,?), ref: 003704A9
sscanf.MSVCRT ref: 003704C5
strstr.MSVCRT ref: 003704DC
lstrlenA.KERNEL32(00362780), ref: 003704F0
lstrlenA.KERNEL32(?), ref: 003704FA
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 00370505
strtok.MSVCRT ref: 0037051B
lstrcpyA.KERNEL32(00000000,00371335), ref: 00370534
_memicmp.MSVCRT ref: 00370557
lstrlenA.KERNEL32(00362780), ref: 00370567
_snprintf.MSVCRT ref: 0037057B
_memicmp.MSVCRT ref: 00370596
lstrcatA.KERNEL32(00000000,00000000), ref: 003705A7
lstrcatA.KERNEL32(00000000,00000000), ref: 003705F1
lstrcatA.KERNEL32(00000000,00372B84), ref: 003705F9
strtok.MSVCRT ref: 00370602
lstrcatA.KERNEL32(00000000,00000000), ref: 0037061C
lstrcatA.KERNEL32(00000000,), ref: 00370624
lstrcatA.KERNEL32(00000000,00362780), ref: 0037062B
lstrlenA.KERNEL32(00000000), ref: 0037062E
_snprintf.MSVCRT ref: 00370646
lstrlenA.KERNEL32(00000000), ref: 0037064F
lstrlenA.KERNEL32(?), ref: 0037065A
HeapAlloc.KERNEL32(?,00000008,00000040), ref: 00370667
_snprintf.MSVCRT ref: 00370688
sscanf.MSVCRT ref: 003706A0
strstr.MSVCRT ref: 003706B7
strstr.MSVCRT ref: 003706D2
lstrlenA.KERNEL32(00000000), ref: 003706E6
lstrlenA.KERNEL32(-00000002), ref: 003706F3
HeapAlloc.KERNEL32(?,00000008,?), ref: 003706FF
lstrlenA.KERNEL32(00000000), ref: 00370714
lstrlenA.KERNEL32(-00000002), ref: 00370721
lstrcpynA.KERNEL32(?,-00000002,?), ref: 0037072C
lstrlenA.KERNEL32(?), ref: 00370736
lstrlenA.KERNEL32(00362780), ref: 0037073E
HeapAlloc.KERNEL32(?,00000008,?), ref: 0037074B
lstrlenA.KERNEL32(?,?,00362780), ref: 00370761
lstrlenA.KERNEL32(00362780), ref: 0037076A
_snprintf.MSVCRT ref: 00370787
HeapFree.KERNEL32(?,00000000,00000000), ref: 0037079F
HeapFree.KERNEL32(?,00000000,?), ref: 003707AC
HeapFree.KERNEL32(?,00000000,00000000), ref: 003707B6

Strings

%s%s, xrefs: 00370680
SDG %d, xrefs: 003704BF
X-MMS-IM-Format: , xrefs: 003704D6, 003705DA
Content-Length: , xrefs: 00370551
MSG %d %s %d%s%s, xrefs: 0037077F
SDG , xrefs: 003704AF
SDG , xrefs: 00370543
SDG %d %d, xrefs: 00370635
Content-Length: %d, xrefs: 0037056A
MSG %d %1s, xrefs: 0037069A
Reliability: , xrefs: 003705B5
, xrefs: 003705A9, 003705CE, 0037061E, 003706CC
From: , xrefs: 00370590

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$Heap$lstrcat$Alloc$_snprintf$Freestrstr$Process_memicmplstrcpysscanfstrtok$lstrcpynmemset
String ID: $%s%s$Content-Length: $Content-Length: %d$From: $MSG %d %1s$MSG %d %s %d%s%s$Reliability: $SDG $SDG $SDG %d$SDG %d %d$X-MMS-IM-Format:
API String ID: 375969099-2909086048
Opcode ID: be52f0853e725a1216d4c3c8296635939dce930f4491a47f95054c8ed5d16452
Instruction ID: 640415462f80565f19ac411b0996135e811611cefd402e2dd0fdab6c511b66c6
Opcode Fuzzy Hash: be52f0853e725a1216d4c3c8296635939dce930f4491a47f95054c8ed5d16452
Instruction Fuzzy Hash: 05A123B6A00209FBDB35DBA48C85EBF77BCEB48710F148555F90CA6241EA78DE449B60

Function 0040F430 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 431filestringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F459
memset.MSVCRT ref: 0040F472
memset.MSVCRT ref: 0040F48B
memset.MSVCRT ref: 0040F4A4
memset.MSVCRT ref: 0040F4BD
memset.MSVCRT ref: 0040F4D6
memset.MSVCRT ref: 0040F4F2
memset.MSVCRT ref: 0040F50B
memset.MSVCRT ref: 0040F526
memset.MSVCRT ref: 0040F541
memset.MSVCRT ref: 0040F55C
sprintf.MSVCRT ref: 0040F571
sprintf.MSVCRT ref: 0040F586
wsprintfW.USER32 ref: 0040F5A4
sprintf.MSVCRT ref: 0040F5BC
sprintf.MSVCRT ref: 0040F5D3
sprintf.MSVCRT ref: 0040F5EC
wsprintfW.USER32 ref: 0040F607
wsprintfW.USER32 ref: 0040F61B

Part of subcall function 00401CF0: GetFileAttributesW.KERNEL32(?), ref: 00401CF7

_stricmp.MSVCRT(00000000,ERR), ref: 0040F64B
_stricmp.MSVCRT(0044A920,00000000), ref: 0040F65D
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040F684
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040F692
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040F6A0
CreateDirectoryA.KERNEL32(?,00000000), ref: 0040F6AA
GetLastError.KERNEL32 ref: 0040F6B4
CopyFileW.KERNEL32 ref: 0040F6CE
lstrlenA.KERNEL32([.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E},00000000), ref: 0040F6DE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F747
lstrcpyA.KERNEL32(?,0000412F), ref: 0040F7DA
lstrcatA.KERNEL32(?,?), ref: 0040F7EE

Part of subcall function 00401EA0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00401ECD
Part of subcall function 00401EA0: GetLastError.KERNEL32 ref: 00401EDA

lstrcatA.KERNEL32(?,00412B84), ref: 0040F800
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F813
lstrlenA.KERNEL32(0000412F,?,00000000), ref: 0040F828
WriteFile.KERNEL32(00000000,0000412F,00000000), ref: 0040F837
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F87C
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F88B
CloseHandle.KERNEL32(00000000), ref: 0040F8B1
Sleep.KERNEL32(00000032), ref: 0040F8C4
SetFileAttributesA.KERNEL32(?,00000004), ref: 0040F901
SetFileAttributesA.KERNEL32(?,00000004), ref: 0040F93A
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040F97D
GetFileSize.KERNEL32(00000000,00000000), ref: 0040F984
LockFile.KERNEL32 ref: 0040F98D
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040F9BE
GetFileSize.KERNEL32(00000000,00000000), ref: 0040F9C5
LockFile.KERNEL32 ref: 0040F9CE

Strings

usbi, xrefs: 0040F6F6, 0040F993
%sautorun.tmp, xrefs: 0040F580
ERR, xrefs: 0040F645
%S%S\Desktop.ini, xrefs: 0040F615
%s%s, xrefs: 0040F5CD, 0040F5E6
[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}, xrefs: 0040F6D9, 0040F6EB
%sautorun.inf, xrefs: 0040F565
%s\%s, xrefs: 0040F5B6

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: File$memset$Attributes$Createsprintf$lstrlen$wsprintf$ErrorLastLockSizeWrite_stricmplstrcat$CloseCopyDirectoryHandleSleeplstrcpy
String ID: %S%S\Desktop.ini$%s%s$%s\%s$%sautorun.inf$%sautorun.tmp$ERR$[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}$usbi
API String ID: 2867265384-3663527224
Opcode ID: 4df2be5e415b0b3a476115ebffda1eb68d588ce83526194ee57101780f3aea5f
Instruction ID: 20836134fac00eae2ec925ea06fa7d357da684dde9e8a3904e95b43267198c2c
Opcode Fuzzy Hash: 4df2be5e415b0b3a476115ebffda1eb68d588ce83526194ee57101780f3aea5f
Instruction Fuzzy Hash: 2BE195B1950218BAD730DB61CC45FEB777CEB48704F0045BAF609A2591D7B8ABC4CBA9

Function 0036F430 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 431filestringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036F459
memset.MSVCRT ref: 0036F472
memset.MSVCRT ref: 0036F48B
memset.MSVCRT ref: 0036F4A4
memset.MSVCRT ref: 0036F4BD
memset.MSVCRT ref: 0036F4D6
memset.MSVCRT ref: 0036F4F2
memset.MSVCRT ref: 0036F50B
memset.MSVCRT ref: 0036F526
memset.MSVCRT ref: 0036F541
memset.MSVCRT ref: 0036F55C
sprintf.MSVCRT ref: 0036F571
sprintf.MSVCRT ref: 0036F586
wsprintfW.USER32 ref: 0036F5A4
sprintf.MSVCRT ref: 0036F5BC
sprintf.MSVCRT ref: 0036F5D3
sprintf.MSVCRT ref: 0036F5EC
wsprintfW.USER32 ref: 0036F607
wsprintfW.USER32 ref: 0036F61B

Part of subcall function 00361CF0: GetFileAttributesW.KERNEL32(?), ref: 00361CF7

_stricmp.MSVCRT(00000000,ERR), ref: 0036F64B
_stricmp.MSVCRT(003AA920,00000000), ref: 0036F65D
SetFileAttributesA.KERNEL32(?,00000080), ref: 0036F684
SetFileAttributesA.KERNEL32(?,00000080), ref: 0036F692
SetFileAttributesA.KERNEL32(?,00000080), ref: 0036F6A0
CreateDirectoryA.KERNEL32(?,00000000), ref: 0036F6AA
GetLastError.KERNEL32 ref: 0036F6B4
CopyFileW.KERNEL32 ref: 0036F6CE
lstrlenA.KERNEL32([.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E},00000000), ref: 0036F6DE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0036F747
lstrcpyA.KERNEL32(?,0000372F), ref: 0036F7DA
lstrcatA.KERNEL32(?,?), ref: 0036F7EE

Part of subcall function 00361EA0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00361ECD
Part of subcall function 00361EA0: GetLastError.KERNEL32 ref: 00361EDA

lstrcatA.KERNEL32(?,00372B84), ref: 0036F800
lstrlenA.KERNEL32(?,?,00000000), ref: 0036F813
lstrlenA.KERNEL32(0000372F,?,00000000), ref: 0036F828
WriteFile.KERNEL32(00000000,0000372F,00000000), ref: 0036F837
lstrlenA.KERNEL32(?,?,00000000), ref: 0036F87C
WriteFile.KERNEL32(00000000,?,00000000), ref: 0036F88B
CloseHandle.KERNEL32(00000000), ref: 0036F8B1
Sleep.KERNEL32(00000032), ref: 0036F8C4
SetFileAttributesA.KERNEL32(?,00000004), ref: 0036F901
SetFileAttributesA.KERNEL32(?,00000004), ref: 0036F93A
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0036F97D
GetFileSize.KERNEL32(00000000,00000000), ref: 0036F984
LockFile.KERNEL32 ref: 0036F98D
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0036F9BE
GetFileSize.KERNEL32(00000000,00000000), ref: 0036F9C5
LockFile.KERNEL32 ref: 0036F9CE

Strings

[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}, xrefs: 0036F6D9, 0036F6EB
%s%s, xrefs: 0036F5CD, 0036F5E6
%sautorun.inf, xrefs: 0036F565
ERR, xrefs: 0036F645
%S%S\Desktop.ini, xrefs: 0036F615
usbi, xrefs: 0036F6F6, 0036F993
%sautorun.tmp, xrefs: 0036F580
%s\%s, xrefs: 0036F5B6

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: File$memset$Attributes$Createsprintf$lstrlen$wsprintf$ErrorLastLockSizeWrite_stricmplstrcat$CloseCopyDirectoryHandleSleeplstrcpy
String ID: %S%S\Desktop.ini$%s%s$%s\%s$%sautorun.inf$%sautorun.tmp$ERR$[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}$usbi
API String ID: 2867265384-3663527224
Opcode ID: 4dcc7d63e8885bd670eef82c73a7ad8339453c055c23c0a2d30338946c95b2a7
Instruction ID: a7a7fc056f54bdcfb8c75744358e17bbb893a6b436a0b566b806db3fb1d4628d
Opcode Fuzzy Hash: 4dcc7d63e8885bd670eef82c73a7ad8339453c055c23c0a2d30338946c95b2a7
Instruction Fuzzy Hash: 86E1B7B2940218AED732DB64DC86FEA777CEF49740F008599F60DA6085D7B46B84CFA1

Function 0040E9F0 Relevance: 75.5, APIs: 31, Strings: 12, Instructions: 271stringfilethreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040EA0F
LoadLibraryW.KERNEL32(ws2_32.dll), ref: 0040EA22
LoadLibraryW.KERNEL32(secur32.dll), ref: 0040EA29
LoadLibraryW.KERNEL32(wininet.dll), ref: 0040EA30
CreateMutexA.KERNEL32(00000000,00000000,004157AC), ref: 0040EA3B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040EA44

Part of subcall function 00407330: memset.MSVCRT ref: 00407351
Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2

CopyFileW.KERNEL32 ref: 0040EACF

Part of subcall function 0040D6B0: RegSetValueExW.ADVAPI32 ref: 0040D731
Part of subcall function 0040D6B0: RegCloseKey.ADVAPI32(?), ref: 0040D740

Sleep.KERNEL32(000003E8), ref: 0040EAFC

Part of subcall function 00401AD0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00401AE9

DeleteFileW.KERNEL32(0044AFB0), ref: 0040EB2F
Sleep.KERNEL32(00003A98), ref: 0040EB3A
DeleteFileW.KERNEL32(0044AFB0), ref: 0040EB41
lstrcpyA.KERNEL32(0044A920,ERR), ref: 0040EB61
lstrlenA.KERNEL32(004157C0), ref: 0040EB72
lstrlenA.KERNEL32(004157C0), ref: 0040EBB5
_snprintf.MSVCRT ref: 0040EBDE
lstrlenA.KERNEL32(00000000), ref: 0040EC15
InitializeCriticalSection.KERNEL32(0044B3C8), ref: 0040EC32
memset.MSVCRT ref: 0040EC5F
wsprintfW.USER32 ref: 0040EC75
DeleteFileW.KERNEL32(?), ref: 0040EC95
GetLastError.KERNEL32 ref: 0040EC97

Part of subcall function 00401CF0: GetFileAttributesW.KERNEL32(?), ref: 00401CF7

CreateThread.KERNEL32(00000000,00000000,Function_0000E880,00000000,00000000,00000000), ref: 0040ECB2
CloseHandle.KERNEL32(00000000), ref: 0040ECBB
CreateThread.KERNEL32(00000000,00000000,0040E990,00000000,00000000,00000000), ref: 0040ECCC
CloseHandle.KERNEL32(00000000), ref: 0040ECCF
lstrlenA.KERNEL32(0044B3E0), ref: 0040ED26
lstrlenA.KERNEL32(0044AC50,?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000), ref: 0040ED5E
CreateThread.KERNEL32(00000000,00000000,Function_0000E770,0044B990,00000000,00000000), ref: 0040ED83
CloseHandle.KERNEL32(00000000), ref: 0040ED86
CreateThread.KERNEL32(00000000,00000000,0040FC90,00000000,00000000,00000000), ref: 0040EDA1
CloseHandle.KERNEL32(00000000), ref: 0040EDA4

Strings

msnint, xrefs: 0040EBE9
running, xrefs: 0040EA7F
ws2_32.dll, xrefs: 0040EA1D
%s:Zone.Identifier, xrefs: 0040EC6F
ngrBot, xrefs: 0040EA84
ERR, xrefs: 0040EB57
msnmsg, xrefs: 0040EB88
wininet.dll, xrefs: 0040EA2B
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040EADF, 0040ED3A
secur32.dll, xrefs: 0040EA24
IPC_Check, xrefs: 0040EA64
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040ED4E

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$File$CloseCreate$HandleThread$DeleteLibraryLoadmemset$SleepTime_snprintf$AttributesCopyCriticalErrorInitializeLastMutexObjectSectionSingleSystemValueWait_vsnprintflstrcpywsprintf
String ID: %s:Zone.Identifier$ERR$IPC_Check$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$msnint$msnmsg$ngrBot$running$secur32.dll$wininet.dll$ws2_32.dll
API String ID: 4164503275-3436408089
Opcode ID: 785f02e02b6062c830e1d19d2130aed33bc429aacb152919f8111683079fffbd
Instruction ID: 291cbe2c5dc0da0963d39d682a8af24ece4c38724fc749192e7a20bc4a0e5367
Opcode Fuzzy Hash: 785f02e02b6062c830e1d19d2130aed33bc429aacb152919f8111683079fffbd
Instruction Fuzzy Hash: 058129B5BC031476F620B7625D47F9B36189B44F04F244437FB04B52D2DAFCA6A08AAE

Function 0036E9F0 Relevance: 75.5, APIs: 31, Strings: 12, Instructions: 271stringfilethreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036EA0F
LoadLibraryW.KERNEL32(ws2_32.dll), ref: 0036EA22
LoadLibraryW.KERNEL32(secur32.dll), ref: 0036EA29
LoadLibraryW.KERNEL32(wininet.dll), ref: 0036EA30
CreateMutexA.KERNEL32(00000000,00000000,003757AC), ref: 0036EA3B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0036EA44

Part of subcall function 00367330: memset.MSVCRT ref: 00367351
Part of subcall function 00367330: lstrlenA.KERNEL32(?), ref: 00367369
Part of subcall function 00367330: _snprintf.MSVCRT ref: 00367381
Part of subcall function 00367330: _vsnprintf.MSVCRT ref: 003673A3
Part of subcall function 00367330: lstrlenA.KERNEL32(00000000), ref: 003673B2

CopyFileW.KERNEL32 ref: 0036EACF

Part of subcall function 0036D6B0: RegSetValueExW.ADVAPI32 ref: 0036D731
Part of subcall function 0036D6B0: RegCloseKey.ADVAPI32(?), ref: 0036D740

Sleep.KERNEL32(000003E8), ref: 0036EAFC

Part of subcall function 00361AD0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00361AE9

DeleteFileW.KERNEL32(003AAFB0), ref: 0036EB2F
Sleep.KERNEL32(00003A98), ref: 0036EB3A
DeleteFileW.KERNEL32(003AAFB0), ref: 0036EB41
lstrcpyA.KERNEL32(003AA920,ERR), ref: 0036EB61
lstrlenA.KERNEL32(003757C0), ref: 0036EB72
lstrlenA.KERNEL32(003757C0), ref: 0036EBB5
_snprintf.MSVCRT ref: 0036EBDE
lstrlenA.KERNEL32(00000000), ref: 0036EC15
InitializeCriticalSection.KERNEL32(003AB3C8), ref: 0036EC32
memset.MSVCRT ref: 0036EC5F
wsprintfW.USER32 ref: 0036EC75
DeleteFileW.KERNEL32(?), ref: 0036EC95
GetLastError.KERNEL32 ref: 0036EC97

Part of subcall function 00361CF0: GetFileAttributesW.KERNEL32(?), ref: 00361CF7

CreateThread.KERNEL32(00000000,00000000,Function_0000E880,00000000,00000000,00000000), ref: 0036ECB2
CloseHandle.KERNEL32(00000000), ref: 0036ECBB
CreateThread.KERNEL32(00000000,00000000,0036E990,00000000,00000000,00000000), ref: 0036ECCC
CloseHandle.KERNEL32(00000000), ref: 0036ECCF
lstrlenA.KERNEL32(003AB3E0), ref: 0036ED26
lstrlenA.KERNEL32(003AAC50,?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000), ref: 0036ED5E
CreateThread.KERNEL32(00000000,00000000,Function_0000E770,003AB990,00000000,00000000), ref: 0036ED83
CloseHandle.KERNEL32(00000000), ref: 0036ED86
CreateThread.KERNEL32(00000000,00000000,0036FC90,00000000,00000000,00000000), ref: 0036EDA1
CloseHandle.KERNEL32(00000000), ref: 0036EDA4

Strings

msnint, xrefs: 0036EBE9
IPC_Check, xrefs: 0036EA64
ERR, xrefs: 0036EB57
secur32.dll, xrefs: 0036EA24
ngrBot, xrefs: 0036EA84
msnmsg, xrefs: 0036EB88
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0036EADF, 0036ED3A
running, xrefs: 0036EA7F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0036ED4E
%s:Zone.Identifier, xrefs: 0036EC6F
ws2_32.dll, xrefs: 0036EA1D
wininet.dll, xrefs: 0036EA2B

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$File$CloseCreate$HandleThread$DeleteLibraryLoadmemset$SleepTime_snprintf$AttributesCopyCriticalErrorInitializeLastMutexObjectSectionSingleSystemValueWait_vsnprintflstrcpywsprintf
String ID: %s:Zone.Identifier$ERR$IPC_Check$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$msnint$msnmsg$ngrBot$running$secur32.dll$wininet.dll$ws2_32.dll
API String ID: 4164503275-3436408089
Opcode ID: 3eeae9711479cb74740bd79a26ce78fec5d0a53f7fd22cc0af4307f74f1ae61c
Instruction ID: f7aed142dd84945b1934cbe5a76ceaee49b44c94a2fd342b0c7cb307c7ebf635
Opcode Fuzzy Hash: 3eeae9711479cb74740bd79a26ce78fec5d0a53f7fd22cc0af4307f74f1ae61c
Instruction Fuzzy Hash: FD81F6BABC03147AE67377A49C47FDB765CDB01F00F14C014FA09BA1D6DBE466448AAA

Function 0040E130 Relevance: 59.8, APIs: 24, Strings: 10, Instructions: 255sleepstringfileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0044B3C8), ref: 0040E14B

Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A013
Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A04F

GetLastError.KERNEL32 ref: 0040E17E
GetLastError.KERNEL32 ref: 0040E18B
GetLastError.KERNEL32 ref: 0040E198
GetLastError.KERNEL32 ref: 0040E1A5
Sleep.KERNEL32(00003A98), ref: 0040E1C8
Sleep.KERNEL32(000003E8), ref: 0040E22B
lstrlenA.KERNEL32(00000000), ref: 0040E24D
_memicmp.MSVCRT ref: 0040E259
MoveFileExW.KERNEL32(00000000,0044ADA0,0000000B), ref: 0040E292
MoveFileExW.KERNEL32(00000000,0044ADA0,00000004), ref: 0040E2A4
lstrcpyA.KERNEL32(0044A920,00000000), ref: 0040E2C0
lstrcmpA.KERNEL32(?,00412C7C), ref: 0040E2D3
Sleep.KERNEL32(000007D0), ref: 0040E2FA
Sleep.KERNEL32(000007D0), ref: 0040E30A

Part of subcall function 0040BA00: memset.MSVCRT ref: 0040BA1E
Part of subcall function 0040BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0040BA42

DeleteFileW.KERNEL32(00000000), ref: 0040E43A
HeapFree.KERNEL32(?,00000000,?), ref: 0040E45D
??3@YAXPAX@Z.MSVCRT(?), ref: 0040E46B
LeaveCriticalSection.KERNEL32(0044B3C8), ref: 0040E478

Strings

[d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0040E383, 0040E3AE
QUIT :%s, xrefs: 0040E2E3
bsod, xrefs: 0040E312
[d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0040E3D1
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0040E36E
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s), xrefs: 0040E359
[d="%s"] Error downloading file [e="%d"], xrefs: 0040E405
[d='%s"] Error getting application data path [e="%d"], xrefs: 0040E3F4
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d, xrefs: 0040E41C
rebooting, xrefs: 0040E2DE

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLastSleep$File$CriticalMoveSectionstrtok$??3@DeleteEnterFreeHeapLeave_memicmplstrcmplstrcpylstrlenmemsetwvsprintf
String ID: QUIT :%s$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$bsod$rebooting
API String ID: 4206007775-4213298338
Opcode ID: 8383eb135d202b3d787de8f53a1fe34e0e97aac98dfb618f54b5d29d449e51f8
Instruction ID: bdb515e0d9e3ba4769888a699288c0d0595d26c5ffdf0716fbe6c9d3270b13c6
Opcode Fuzzy Hash: 8383eb135d202b3d787de8f53a1fe34e0e97aac98dfb618f54b5d29d449e51f8
Instruction Fuzzy Hash: 9381A9B0A40304BBE7109BA6DC45FAF7778EF44704B20893BFA51B22D1D67899508A6E

Function 0036E130 Relevance: 59.8, APIs: 24, Strings: 10, Instructions: 255sleepstringfileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(003AB3C8), ref: 0036E14B

Part of subcall function 00369FF0: strtok.MSVCRT ref: 0036A013
Part of subcall function 00369FF0: strtok.MSVCRT ref: 0036A04F

GetLastError.KERNEL32 ref: 0036E17E
GetLastError.KERNEL32 ref: 0036E18B
GetLastError.KERNEL32 ref: 0036E198
GetLastError.KERNEL32 ref: 0036E1A5
Sleep.KERNEL32(00003A98), ref: 0036E1C8
Sleep.KERNEL32(000003E8), ref: 0036E22B
lstrlenA.KERNEL32(00000000), ref: 0036E24D
_memicmp.MSVCRT ref: 0036E259
MoveFileExW.KERNEL32(00000000,003AADA0,0000000B), ref: 0036E292
MoveFileExW.KERNEL32(00000000,003AADA0,00000004), ref: 0036E2A4
lstrcpyA.KERNEL32(003AA920,00000000), ref: 0036E2C0
lstrcmpA.KERNEL32(?,00372C7C), ref: 0036E2D3
Sleep.KERNEL32(000007D0), ref: 0036E2FA
Sleep.KERNEL32(000007D0), ref: 0036E30A

Part of subcall function 0036BA00: memset.MSVCRT ref: 0036BA1E
Part of subcall function 0036BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0036BA42

DeleteFileW.KERNEL32(00000000), ref: 0036E43A
HeapFree.KERNEL32(?,00000000,?), ref: 0036E45D
??3@YAXPAX@Z.MSVCRT(?), ref: 0036E46B
LeaveCriticalSection.KERNEL32(003AB3C8), ref: 0036E478

Strings

[d="%s"] Error downloading file [e="%d"], xrefs: 0036E405
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0036E36E
[d='%s"] Error getting application data path [e="%d"], xrefs: 0036E3F4
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d, xrefs: 0036E41C
bsod, xrefs: 0036E312
QUIT :%s, xrefs: 0036E2E3
[d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0036E3D1
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s), xrefs: 0036E359
[d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0036E383, 0036E3AE
rebooting, xrefs: 0036E2DE

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ErrorLastSleep$File$CriticalMoveSectionstrtok$??3@DeleteEnterFreeHeapLeave_memicmplstrcmplstrcpylstrlenmemsetwvsprintf
String ID: QUIT :%s$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$bsod$rebooting
API String ID: 4206007775-4213298338
Opcode ID: 70f21101d7a450ccd57037313d8d2b0f577cb8c6890245c20bf77ef52620b917
Instruction ID: 7b020ad2f94e195caf524fe1e0407d975ff556cf6965f68d8e00b3753fb0bb02
Opcode Fuzzy Hash: 70f21101d7a450ccd57037313d8d2b0f577cb8c6890245c20bf77ef52620b917
Instruction Fuzzy Hash: E681E3BAA00204BFDB23ABA8CC4AEBE777CEF46700F50C515F945D6285DB709944DA22

Function 0040DDB0 Relevance: 56.3, APIs: 20, Strings: 12, Instructions: 281sleepstringmemoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0044B3C8), ref: 0040DDCF

Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A013
Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A04F

strstr.MSVCRT ref: 0040DDF4
lstrlenA.KERNEL32(?), ref: 0040DE11
toupper.MSVCRT ref: 0040DE28
GetLastError.KERNEL32 ref: 0040DE68
GetLastError.KERNEL32 ref: 0040DE71
GetLastError.KERNEL32 ref: 0040DE7A
GetLastError.KERNEL32 ref: 0040DE83
Sleep.KERNEL32(00003A98), ref: 0040DEA8
Sleep.KERNEL32(000003E8), ref: 0040DF16
_stricmp.MSVCRT(?,00000000), ref: 0040DF3D
Sleep.KERNEL32(00000032), ref: 0040DF6A
GetLastError.KERNEL32([d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"],?,?,?,00000000), ref: 0040E021
GetLastError.KERNEL32 ref: 0040E059
GetLastError.KERNEL32([d="%s" s="%d bytes"] Error creating process "%S" [e="%d"],?,?,?,00000000), ref: 0040E037

Part of subcall function 0040BA00: memset.MSVCRT ref: 0040BA1E
Part of subcall function 0040BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0040BA42

HeapFree.KERNEL32(?,00000000,?), ref: 0040E0DD
??3@YAXPAX@Z.MSVCRT(?), ref: 0040E0EB
LeaveCriticalSection.KERNEL32(0044B3C8), ref: 0040E0F8

Strings

[d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0040E042
dlds, xrefs: 0040DE44, 0040DFA6
ERR, xrefs: 0040DFEC
[d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0040E060
http://, xrefs: 0040DDEE
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0040E017
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"], xrefs: 0040E030
[d="%s"] Error downloading file [e="%d"], xrefs: 0040E08E
[d='%s"] Error getting application data path [e="%d"], xrefs: 0040E080
exe, xrefs: 0040DEE4
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s), xrefs: 0040DFFE
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d, xrefs: 0040E0A5

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLast$Sleep$CriticalSectionstrtok$??3@EnterFreeHeapLeave_stricmplstrlenmemsetstrstrtoupperwvsprintf
String ID: ERR$[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]$[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$dlds$exe$http://
API String ID: 3190375853-4059846736
Opcode ID: f986f074c990c97db4eed9869a16002373fbc8f9448da8be0168c0ee2a9dd183
Instruction ID: 3e91a635f220bf852c08f817978a574d76a59c4a97b8cc3da9307b122ab73dc0
Opcode Fuzzy Hash: f986f074c990c97db4eed9869a16002373fbc8f9448da8be0168c0ee2a9dd183
Instruction Fuzzy Hash: 0591B3B5E00205ABD710DBD5CC85ABFB3B8EB94704F20843AE905B72C5D778E945C6AE

Function 0036DDB0 Relevance: 56.3, APIs: 20, Strings: 12, Instructions: 281sleepstringmemoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(003AB3C8), ref: 0036DDCF

Part of subcall function 00369FF0: strtok.MSVCRT ref: 0036A013
Part of subcall function 00369FF0: strtok.MSVCRT ref: 0036A04F

strstr.MSVCRT ref: 0036DDF4
lstrlenA.KERNEL32(?), ref: 0036DE11
toupper.MSVCRT ref: 0036DE28
GetLastError.KERNEL32 ref: 0036DE68
GetLastError.KERNEL32 ref: 0036DE71
GetLastError.KERNEL32 ref: 0036DE7A
GetLastError.KERNEL32 ref: 0036DE83
Sleep.KERNEL32(00003A98), ref: 0036DEA8
Sleep.KERNEL32(000003E8), ref: 0036DF16
_stricmp.MSVCRT(?,00000000), ref: 0036DF3D
Sleep.KERNEL32(00000032), ref: 0036DF6A
GetLastError.KERNEL32([d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"],?,?,?,00000000), ref: 0036E021
GetLastError.KERNEL32 ref: 0036E059
GetLastError.KERNEL32([d="%s" s="%d bytes"] Error creating process "%S" [e="%d"],?,?,?,00000000), ref: 0036E037

Part of subcall function 0036BA00: memset.MSVCRT ref: 0036BA1E
Part of subcall function 0036BA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 0036BA42

HeapFree.KERNEL32(?,00000000,?), ref: 0036E0DD
??3@YAXPAX@Z.MSVCRT(?), ref: 0036E0EB
LeaveCriticalSection.KERNEL32(003AB3C8), ref: 0036E0F8

Strings

[d="%s"] Error downloading file [e="%d"], xrefs: 0036E08E
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"], xrefs: 0036E030
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 0036E017
ERR, xrefs: 0036DFEC
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s), xrefs: 0036DFFE
http://, xrefs: 0036DDEE
dlds, xrefs: 0036DE44, 0036DFA6
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d, xrefs: 0036E0A5
[d='%s"] Error getting application data path [e="%d"], xrefs: 0036E080
[d="%s"] Error getting temporary filename. [e="%d"], xrefs: 0036E060
[d="%s"] Error writing download to "%S" [e="%d"], xrefs: 0036E042
exe, xrefs: 0036DEE4

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ErrorLast$Sleep$CriticalSectionstrtok$??3@EnterFreeHeapLeave_stricmplstrlenmemsetstrstrtoupperwvsprintf
String ID: ERR$[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]$[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$dlds$exe$http://
API String ID: 3190375853-4059846736
Opcode ID: 677c5a195f558491eea96f594a5a79774bced9725ab31d434562c1e30fe814d5
Instruction ID: 4ea52c0c7527510d24600fc4040e728e0b46326845e4aec4a9f9b16a58c6a432
Opcode Fuzzy Hash: 677c5a195f558491eea96f594a5a79774bced9725ab31d434562c1e30fe814d5
Instruction Fuzzy Hash: 4391B479F00205AFD726DB98CC86EBFB7BCAB54700F15C018E50A9B289D7B5AE40C761

Function 00407870 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 249stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407898
lstrlenA.KERNEL32(-00000005,00000000,00000000,?,?,?,00000000,?), ref: 0040795D
_snprintf.MSVCRT ref: 0040797B
_snprintf.MSVCRT ref: 004079B7
lstrlenA.KERNEL32(0044A2B0,?,00000000,?), ref: 00407A5A
lstrlenA.KERNEL32(0044A4B0), ref: 00407A69
_snprintf.MSVCRT ref: 00407AD9
_stricmp.MSVCRT(0044A2B0,anonymous,00000000,000001FF,ftp://%s:%s@%s:%d,0044A2B0,0044A4B0,00000000,00000000), ref: 00407AE8
_snprintf.MSVCRT ref: 00407B66

Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
Part of subcall function 00402460: HeapAlloc.KERNEL32(?,00000008,004020DE,?,004020DE,?), ref: 0040247E

lstrcpyA.KERNEL32(0044A2B0,00411335,?,00000000,?), ref: 00407BBC
lstrcpyA.KERNEL32(0044A4B0,00411335), ref: 00407BC8

Strings

block, xrefs: 00407B09, 00407B7C
ftpgrab, xrefs: 00407AA6
TYPE, xrefs: 00407A01
%s.%s (p='%S'), xrefs: 00407B9F
USER, xrefs: 004078F1
poplog, xrefs: 00407B9A
STAT, xrefs: 00407A1B
LIST, xrefs: 00407A22
popgrab, xrefs: 00407B37
%s:%s@%s:%d, xrefs: 00407B04, 00407B77
FEAT, xrefs: 004079FA
ftp://%s:%s@%s:%d, xrefs: 00407AC8
pop3://%s:%s@%s:%d, xrefs: 00407B55
ftplog, xrefs: 00407B2B
PASV, xrefs: 00407A08
anonymous, xrefs: 00407ADE
PASS, xrefs: 004078F8

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: _snprintf$lstrlen$Heaplstrcpy$AllocProcess_stricmpmemset
String ID: %s.%s (p='%S')$%s:%s@%s:%d$FEAT$LIST$PASS$PASV$STAT$TYPE$USER$anonymous$block$ftp://%s:%s@%s:%d$ftpgrab$ftplog$pop3://%s:%s@%s:%d$popgrab$poplog
API String ID: 389836911-2374598668
Opcode ID: 0e370dc052ecfbd7fb3f7bbf5e19c0d235bc1fe5bf087733f40848c40f85a7b1
Instruction ID: 4ec03147278e1debc2a34b89434d2914110906d41f31d0f6576211e9510b2703
Opcode Fuzzy Hash: 0e370dc052ecfbd7fb3f7bbf5e19c0d235bc1fe5bf087733f40848c40f85a7b1
Instruction Fuzzy Hash: 8D811B70F883556AFB20EF648C49FAF3A645B01708F19447BE904B23D1D6BCB994865F

Function 00367870 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 249stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00367898
lstrlenA.KERNEL32(-00000005,00000000,00000000,?,?,?,00000000,?), ref: 0036795D
_snprintf.MSVCRT ref: 0036797B
_snprintf.MSVCRT ref: 003679B7
lstrlenA.KERNEL32(003AA2B0,?,00000000,?), ref: 00367A5A
lstrlenA.KERNEL32(003AA4B0), ref: 00367A69
_snprintf.MSVCRT ref: 00367AD9
_stricmp.MSVCRT(003AA2B0,anonymous,00000000,000001FF,ftp://%s:%s@%s:%d,003AA2B0,003AA4B0,00000000,00000000), ref: 00367AE8
_snprintf.MSVCRT ref: 00367B66

Part of subcall function 00362460: GetProcessHeap.KERNEL32(?,003620DE,?), ref: 0036246C
Part of subcall function 00362460: HeapAlloc.KERNEL32(?,00000008,003620DE,?,003620DE,?), ref: 0036247E

lstrcpyA.KERNEL32(003AA2B0,00371335,?,00000000,?), ref: 00367BBC
lstrcpyA.KERNEL32(003AA4B0,00371335), ref: 00367BC8

Strings

%s:%s@%s:%d, xrefs: 00367B04, 00367B77
ftpgrab, xrefs: 00367AA6
ftp://%s:%s@%s:%d, xrefs: 00367AC8
anonymous, xrefs: 00367ADE
STAT, xrefs: 00367A1B
poplog, xrefs: 00367B9A
PASS, xrefs: 003678F8
%s.%s (p='%S'), xrefs: 00367B9F
LIST, xrefs: 00367A22
TYPE, xrefs: 00367A01
USER, xrefs: 003678F1
PASV, xrefs: 00367A08
popgrab, xrefs: 00367B37
FEAT, xrefs: 003679FA
block, xrefs: 00367B09, 00367B7C
ftplog, xrefs: 00367B2B
pop3://%s:%s@%s:%d, xrefs: 00367B55

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: _snprintf$lstrlen$Heaplstrcpy$AllocProcess_stricmpmemset
String ID: %s.%s (p='%S')$%s:%s@%s:%d$FEAT$LIST$PASS$PASV$STAT$TYPE$USER$anonymous$block$ftp://%s:%s@%s:%d$ftpgrab$ftplog$pop3://%s:%s@%s:%d$popgrab$poplog
API String ID: 389836911-2374598668
Opcode ID: 7fc4ad55d98ef60cd8711143c3126e87d22817d074550dd0e271ddad913021d8
Instruction ID: 6c87243e6df62feda7b675a45a262f64d400c7ad8946784ab9d90273cf123207
Opcode Fuzzy Hash: 7fc4ad55d98ef60cd8711143c3126e87d22817d074550dd0e271ddad913021d8
Instruction Fuzzy Hash: BC815C72A487456ADB33AF68CC46FAE3AD8DB0271CF89C415F408A7299D7B49D80C653

Function 00370910 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 172sleepstringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00370930
GetProcessHeap.KERNEL32 ref: 0037093D
memset.MSVCRT ref: 0037095D
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00370982
ShellExecuteA.SHELL32(00000000,OPEN,00000000,00000000,00000000,00000005), ref: 003709BF

Part of subcall function 003673E0: memset.MSVCRT ref: 00367401
Part of subcall function 003673E0: memset.MSVCRT ref: 00367419
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 00367431
Part of subcall function 003673E0: _snprintf.MSVCRT ref: 00367449
Part of subcall function 003673E0: _vsnprintf.MSVCRT ref: 0036746B
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 0036747A

GetTickCount.KERNEL32 ref: 003709CF
Sleep.KERNEL32 ref: 00370A05
OpenMutexA.KERNEL32 ref: 00370A17
GetLastError.KERNEL32 ref: 00370A27
GetLastError.KERNEL32 ref: 00370A2E
ExitProcess.KERNEL32 ref: 00370A32
lstrlenA.KERNEL32(30e44aa1), ref: 00370A3D
_snprintf.MSVCRT ref: 00370A60
ExitProcess.KERNEL32 ref: 00370A79
ExitProcess.KERNEL32 ref: 00370A98
GetModuleFileNameW.KERNEL32(00000000,003AAFB0,00000208), ref: 00370ACC
wsprintfW.USER32 ref: 00370ADE
WideCharToMultiByte.KERNEL32(00000000,00000000,003AADA0,000000FF,003AAC50,00000104,00000000,00000000), ref: 00370B06
lstrcpynW.KERNEL32(003AB1B8,00000000,00000208), ref: 00370B13
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,003AB3E0,00000104,00000000,00000000), ref: 00370B2E
Sleep.KERNEL32(000009C4), ref: 00370B59
ExitProcess.KERNEL32 ref: 00370B70

Strings

30e44aa1, xrefs: 00370A38, 00370A44
OPEN, xrefs: 003709B8
ngrBot, xrefs: 00370A84, 00370AA3
running, xrefs: 00370A7F, 00370A9E
%s\Microsoft\%s.exe, xrefs: 00370AD4
%08x, xrefs: 00370A4F

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Process$Exitmemset$lstrlen$ByteCharErrorFileLastModuleMultiNameSleepWide_snprintf$CountExecuteHeapMutexOpenShellTick_vsnprintflstrcpynwsprintf
String ID: %08x$%s\Microsoft\%s.exe$30e44aa1$OPEN$ngrBot$running
API String ID: 2173303953-2917108782
Opcode ID: 2a2dfe5072ed500c96ebfa8ca99d62f5fca3c6ba4df87e00ad974e162666ad5f
Instruction ID: fda1c0cb62378f9867686b1371f5ffeb9c9b2f334cf5d9e22c268556812758b4
Opcode Fuzzy Hash: 2a2dfe5072ed500c96ebfa8ca99d62f5fca3c6ba4df87e00ad974e162666ad5f
Instruction Fuzzy Hash: B451D876A80304BBE777A7B49C4BFDA3A6C9B45B11F00C454F70DEA1D2DAF455808B62

Function 0040FE00 Relevance: 48.2, APIs: 32, Instructions: 223stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,0041037C,?,004132E4,00000000,00000000,httpi), ref: 0040FE11
lstrlenA.KERNEL32(?), ref: 0040FE40
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0040FE47
lstrlenA.KERNEL32(?), ref: 0040FE5E
lstrlenA.KERNEL32(?), ref: 0040FE72
lstrlenA.KERNEL32(?), ref: 0040FE7C
HeapAlloc.KERNEL32(?,00000008,00000002), ref: 0040FE89
strtok.MSVCRT ref: 0040FEA2
lstrcpyA.KERNEL32(00000000,00411335), ref: 0040FEBB
lstrcatA.KERNEL32(00000000,004119DC), ref: 0040FECD
lstrlenA.KERNEL32(00000000), ref: 0040FEE4
_memicmp.MSVCRT ref: 0040FEEF
lstrcatA.KERNEL32(00000000,?), ref: 0040FF0A
lstrlenA.KERNEL32(?), ref: 0040FF14
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0040FF1F
lstrlenA.KERNEL32(?), ref: 0040FF33
lstrcatA.KERNEL32(00000000,00413328), ref: 0040FF4B
strstr.MSVCRT ref: 0040FF5C
lstrlenA.KERNEL32(00000000), ref: 0040FF65
lstrlenA.KERNEL32(?), ref: 0040FF6B
strncat.MSVCRT ref: 0040FF77
lstrcatA.KERNEL32(00000000,00412B54), ref: 0040FF85
lstrlenA.KERNEL32(?), ref: 0040FF8F
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0040FF9A
lstrlenA.KERNEL32(?), ref: 0040FFAA

Part of subcall function 0040FD80: isalnum.MSVCRT ref: 0040FDAC
Part of subcall function 0040FD80: strchr.MSVCRT ref: 0040FDBE

lstrcatA.KERNEL32(00000000,00000000), ref: 0040FFBE
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040FFCB
lstrcatA.KERNEL32(00000000,?), ref: 0040FFDF
strtok.MSVCRT ref: 0040FFEC
HeapFree.KERNEL32(?,00000000,?), ref: 0041000F
HeapFree.KERNEL32(?,00000000,00000000), ref: 0041001C
HeapFree.KERNEL32(?,00000000,00000000), ref: 0041003C

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$Heap$lstrcat$AllocFree$strtok$Process_memicmpisalnumlstrcpystrchrstrncatstrstr
String ID:
API String ID: 423345748-0
Opcode ID: ae5a00cf89488068b5b6207a80ca6a947a741f35cae490951e5afd2dcd30bff6
Instruction ID: ecdf31bace6aa1cfd498af2b81100673c9cff0bf93b629e0d4807f5436e9076f
Opcode Fuzzy Hash: ae5a00cf89488068b5b6207a80ca6a947a741f35cae490951e5afd2dcd30bff6
Instruction Fuzzy Hash: 75616075A00205BBDB209FA5DC85EFF7B78AF48705F10412AFA04E7390DA78DD8587A8

Function 0036FE00 Relevance: 48.2, APIs: 32, Instructions: 223stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,0037037C,?,003732E4,00000000,00000000,httpi), ref: 0036FE11
lstrlenA.KERNEL32(?), ref: 0036FE40
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0036FE47
lstrlenA.KERNEL32(?), ref: 0036FE5E
lstrlenA.KERNEL32(?), ref: 0036FE72
lstrlenA.KERNEL32(?), ref: 0036FE7C
HeapAlloc.KERNEL32(?,00000008,00000002), ref: 0036FE89
strtok.MSVCRT ref: 0036FEA2
lstrcpyA.KERNEL32(00000000,00371335), ref: 0036FEBB
lstrcatA.KERNEL32(00000000,003719DC), ref: 0036FECD
lstrlenA.KERNEL32(00000000), ref: 0036FEE4
_memicmp.MSVCRT ref: 0036FEEF
lstrcatA.KERNEL32(00000000,?), ref: 0036FF0A
lstrlenA.KERNEL32(?), ref: 0036FF14
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0036FF1F
lstrlenA.KERNEL32(?), ref: 0036FF33
lstrcatA.KERNEL32(00000000,00373328), ref: 0036FF4B
strstr.MSVCRT ref: 0036FF5C
lstrlenA.KERNEL32(00000000), ref: 0036FF65
lstrlenA.KERNEL32(?), ref: 0036FF6B
strncat.MSVCRT ref: 0036FF77
lstrcatA.KERNEL32(00000000,00372B54), ref: 0036FF85
lstrlenA.KERNEL32(?), ref: 0036FF8F
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0036FF9A
lstrlenA.KERNEL32(?), ref: 0036FFAA

Part of subcall function 0036FD80: isalnum.MSVCRT ref: 0036FDAC
Part of subcall function 0036FD80: strchr.MSVCRT ref: 0036FDBE

lstrcatA.KERNEL32(00000000,00000000), ref: 0036FFBE
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036FFCB
lstrcatA.KERNEL32(00000000,?), ref: 0036FFDF
strtok.MSVCRT ref: 0036FFEC
HeapFree.KERNEL32(?,00000000,?), ref: 0037000F
HeapFree.KERNEL32(?,00000000,00000000), ref: 0037001C
HeapFree.KERNEL32(?,00000000,00000000), ref: 0037003C

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$Heap$lstrcat$AllocFree$strtok$Process_memicmpisalnumlstrcpystrchrstrncatstrstr
String ID:
API String ID: 423345748-0
Opcode ID: 22e780dd61ca2fa5d9b77d1aabed33c7d822d9b4b6d541a8673515bc87deee7a
Instruction ID: f423e5c862619d82f76e769ad20f7700535f8f1fbd573f5aeeef182b51a3f8b6
Opcode Fuzzy Hash: 22e780dd61ca2fa5d9b77d1aabed33c7d822d9b4b6d541a8673515bc87deee7a
Instruction Fuzzy Hash: A8616176A00205BFDB229BA8DC85EBF777CAB48754F108119F908DB244DB78D981D7A0

Function 004099B0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 205networkstringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004099D5
memset.MSVCRT ref: 004099EF
WSAStartup.WS2_32(00000002,?), ref: 00409A00

Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313

htons.WS2_32(00000050), ref: 00409A28
GetTickCount.KERNEL32(00000050,?), ref: 00409A3A
GetTickCount.KERNEL32 ref: 00409A4D
socket.WS2_32(00000002,00000001,00000000), ref: 00409A7B
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00409A96
connect.WS2_32(?,?,00000010), ref: 00409AB1
Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 00409ABE
GetTickCount.KERNEL32 ref: 00409AC4
lstrcpyA.KERNEL32(00000000,X-a: b), ref: 00409AFE
lstrcpyA.KERNEL32(00000000,Connection: Close), ref: 00409B0C
lstrlenA.KERNEL32(00000000), ref: 00409B0F
send.WS2_32(?,00000000,00000000,00000000), ref: 00409B41
Sleep.KERNEL32(000003E8,?,00000000,00000000,00000000), ref: 00409B51
lstrlenA.KERNEL32(00000000), ref: 00409B5E
GetTickCount.KERNEL32 ref: 00409B66
Sleep.KERNEL32(000009C4), ref: 00409B7F
send.WS2_32(?,00000000,00000000,00000000), ref: 00409BBE
GetTickCount.KERNEL32(?,00000000,00000000,00000000), ref: 00409BD2
lstrlenA.KERNEL32(00000000), ref: 00409BE4
send.WS2_32(?,00000000,00000000,00000000), ref: 00409C1E
closesocket.WS2_32(?), ref: 00409C38
GetTickCount.KERNEL32(?,?,00000000,00000000,00000000), ref: 00409C43

Strings

X-a: b, xrefs: 00409AF0
Connection: Close, xrefs: 00409B00

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CountTick$Sleeplstrlensend$lstrcpymemset$Startupclosesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
String ID: Connection: Close$X-a: b
API String ID: 1989272289-3524857483
Opcode ID: f35408606652e46185f76e06ca93f5c32642c9aae835a1c13394b773f809ad83
Instruction ID: 7cb26ec54ccc07fb4d2b8a21b45d65960398a2891f86cebd2f8e54a067ade358
Opcode Fuzzy Hash: f35408606652e46185f76e06ca93f5c32642c9aae835a1c13394b773f809ad83
Instruction Fuzzy Hash: 2F713071940254BBD710EBA1DD45FDEB378AB88704F10897AEA09F31D1D674AE81CF98

Function 003699B0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 205networkstringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003699D5
memset.MSVCRT ref: 003699EF
WSAStartup.WS2_32(00000002,?), ref: 00369A00

Part of subcall function 00369300: inet_addr.WS2_32(n"6), ref: 00369308
Part of subcall function 00369300: gethostbyname.WS2_32(n"6), ref: 00369313

htons.WS2_32(00000050), ref: 00369A28
GetTickCount.KERNEL32(00000050,?), ref: 00369A3A
GetTickCount.KERNEL32 ref: 00369A4D
socket.WS2_32(00000002,00000001,00000000), ref: 00369A7B
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00369A96
connect.WS2_32(?,?,00000010), ref: 00369AB1
Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 00369ABE
GetTickCount.KERNEL32 ref: 00369AC4
lstrcpyA.KERNEL32(00000000,X-a: b), ref: 00369AFE
lstrcpyA.KERNEL32(00000000,Connection: Close), ref: 00369B0C
lstrlenA.KERNEL32(00000000), ref: 00369B0F
send.WS2_32(?,00000000,00000000,00000000), ref: 00369B41
Sleep.KERNEL32(000003E8,?,00000000,00000000,00000000), ref: 00369B51
lstrlenA.KERNEL32(00000000), ref: 00369B5E
GetTickCount.KERNEL32 ref: 00369B66
Sleep.KERNEL32(000009C4), ref: 00369B7F
send.WS2_32(?,00000000,00000000,00000000), ref: 00369BBE
GetTickCount.KERNEL32(?,00000000,00000000,00000000), ref: 00369BD2
lstrlenA.KERNEL32(00000000), ref: 00369BE4
send.WS2_32(?,00000000,00000000,00000000), ref: 00369C1E
closesocket.WS2_32(?), ref: 00369C38
GetTickCount.KERNEL32(?,?,00000000,00000000,00000000), ref: 00369C43

Strings

Connection: Close, xrefs: 00369B00
X-a: b, xrefs: 00369AF0

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CountTick$Sleeplstrlensend$lstrcpymemset$Startupclosesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
String ID: Connection: Close$X-a: b
API String ID: 1989272289-3524857483
Opcode ID: aa921787c2fd7cae5862af6a1dade1947ecb8d2fd0d23d107454cba74a7930f3
Instruction ID: 5930f3b0dcbe1883dc63007a31630af5433df169f896a85eb7d1770209fafab4
Opcode Fuzzy Hash: aa921787c2fd7cae5862af6a1dade1947ecb8d2fd0d23d107454cba74a7930f3
Instruction Fuzzy Hash: 7371EC72900118ABD732EBA4DC85FDE77ADEB88700F51C956EA0DEB184D6749E41CF90

Function 0040AFA0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 149stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0040AFBD
HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 0040AFCB
memset.MSVCRT ref: 0040AFE8
memset.MSVCRT ref: 0040B002
lstrlenA.KERNEL32(?), ref: 0040B013
sscanf.MSVCRT ref: 0040B02A
strtok.MSVCRT ref: 0040B041
_memicmp.MSVCRT ref: 0040B05B
strtok.MSVCRT ref: 0040B06E
lstrlenA.KERNEL32(-00000006), ref: 0040B082
lstrcpynA.KERNEL32(00000000,-00000006,00000001), ref: 0040B08E
lstrlenA.KERNEL32(00000000), ref: 0040B09B
lstrlenA.KERNEL32(00000000), ref: 0040B0AD
lstrlenA.KERNEL32(00000000), ref: 0040B0BB
lstrlenA.KERNEL32(00000000), ref: 0040B0C6
HeapAlloc.KERNEL32(?,00000000,?), ref: 0040B0D5
_memicmp.MSVCRT ref: 0040B0EB
_snprintf.MSVCRT ref: 0040B106
_snprintf.MSVCRT ref: 0040B125
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040B13C

Strings

POST /%1023s, xrefs: 0040B024
http://%s/%s, xrefs: 0040B11E
HTTP, xrefs: 0040B0E3
Host: , xrefs: 0040B055
http://%s/, xrefs: 0040B0FF

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$Heap$Alloc_memicmp_snprintfmemsetstrtok$Freelstrcpynsscanf
String ID: HTTP$Host: $POST /%1023s$http://%s/$http://%s/%s
API String ID: 3179755921-1264106924
Opcode ID: 6a7b048e49f5e46d75e327f42497c877a8154ec3d200563e306c4c1fee2733ba
Instruction ID: b9d19011a538f4e63f226923da5865426bd74754d0a48babbb538e4dd702a74a
Opcode Fuzzy Hash: 6a7b048e49f5e46d75e327f42497c877a8154ec3d200563e306c4c1fee2733ba
Instruction Fuzzy Hash: 704107B6D8021877D720EB618D42FEB736CDB44750F0444A6FB08F2181E6B89A958BED

Function 0036AFA0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 149stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0036AFBD
HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 0036AFCB
memset.MSVCRT ref: 0036AFE8
memset.MSVCRT ref: 0036B002
lstrlenA.KERNEL32(?), ref: 0036B013
sscanf.MSVCRT ref: 0036B02A
strtok.MSVCRT ref: 0036B041
_memicmp.MSVCRT ref: 0036B05B
strtok.MSVCRT ref: 0036B06E
lstrlenA.KERNEL32(-00000006), ref: 0036B082
lstrcpynA.KERNEL32(00000000,-00000006,00000001), ref: 0036B08E
lstrlenA.KERNEL32(00000000), ref: 0036B09B
lstrlenA.KERNEL32(00000000), ref: 0036B0AD
lstrlenA.KERNEL32(00000000), ref: 0036B0BB
lstrlenA.KERNEL32(00000000), ref: 0036B0C6
HeapAlloc.KERNEL32(?,00000000,?), ref: 0036B0D5
_memicmp.MSVCRT ref: 0036B0EB
_snprintf.MSVCRT ref: 0036B106
_snprintf.MSVCRT ref: 0036B125
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036B13C

Strings

POST /%1023s, xrefs: 0036B024
HTTP, xrefs: 0036B0E3
Host: , xrefs: 0036B055
http://%s/%s, xrefs: 0036B11E
http://%s/, xrefs: 0036B0FF

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$Heap$Alloc_memicmp_snprintfmemsetstrtok$Freelstrcpynsscanf
String ID: HTTP$Host: $POST /%1023s$http://%s/$http://%s/%s
API String ID: 3179755921-1264106924
Opcode ID: 7f7ac1848b959075ae68d994c6568a9f2d74d18bfd95b842e533003d5e6dec95
Instruction ID: c5b3942b70ec49dd057bcc01e589a3d67f3b2ee074f4d30028f536f15dbf91e7
Opcode Fuzzy Hash: 7f7ac1848b959075ae68d994c6568a9f2d74d18bfd95b842e533003d5e6dec95
Instruction Fuzzy Hash: 8641D6B6940218BBD736A7A48C42FEBB3ACDB45710F048594FB0CE6145E7749A858BE1

Function 00406A40 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 166stringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406A68
lstrlenA.KERNEL32 ref: 00406B03
_memicmp.MSVCRT ref: 00406B0E
_memicmp.MSVCRT ref: 00406B22
_memicmp.MSVCRT ref: 00406B36
sscanf.MSVCRT ref: 00406B4F
sscanf.MSVCRT ref: 00406B69
lstrlenA.KERNEL32(?), ref: 00406BD5
SetFileAttributesW.KERNEL32(0044A710,00000080), ref: 00406C31
MoveFileExW.KERNEL32(0044A710,00000000,00000004), ref: 00406C40
closesocket.WS2_32(?), ref: 00406C60
ExitThread.KERNEL32 ref: 00406C67

Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464

Strings

block, xrefs: 00406BB7
JOIN %255s, xrefs: 00406B49
%s:%d, xrefs: 00406AAD, 00406BB2
PRIVMSG, xrefs: 00406B30
PRIVMSG %255s, xrefs: 00406B63
JOIN, xrefs: 00406B1C
pdef, xrefs: 00406A8F
%s.Detected process "%S" sending an IRC packet to server %s:%d., xrefs: 00406C0D
%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s)., xrefs: 00406BF2
cnc, xrefs: 00406AB2

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$memset$File_memicmp$CriticalSectionsprintfsscanf$AttributesCreateEnterExitLeaveMoveThread_snprintf_vsnprintfclosesocket
String ID: %s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).$%s.Detected process "%S" sending an IRC packet to server %s:%d.$%s:%d$JOIN$JOIN %255s$PRIVMSG$PRIVMSG %255s$block$cnc$pdef
API String ID: 1085873876-1467418891
Opcode ID: e046ed22e18b5f022a18a89072ff7c27e4d94646e1ec26cf3a102e4814f05911
Instruction ID: 423ddb9557b74d048bf2445d23ea001235c7c8144a5ecbbbaa60eb2ae93ad116
Opcode Fuzzy Hash: e046ed22e18b5f022a18a89072ff7c27e4d94646e1ec26cf3a102e4814f05911
Instruction Fuzzy Hash: A0510A71A402147AEB20AB558C86FDF7378AB44744F15443BFE05B22D1D6BCA9A0C66E

Function 00366A40 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 166stringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00366A68
lstrlenA.KERNEL32 ref: 00366B03
_memicmp.MSVCRT ref: 00366B0E
_memicmp.MSVCRT ref: 00366B22
_memicmp.MSVCRT ref: 00366B36
sscanf.MSVCRT ref: 00366B4F
sscanf.MSVCRT ref: 00366B69
lstrlenA.KERNEL32(?), ref: 00366BD5
SetFileAttributesW.KERNEL32(003AA710,00000080), ref: 00366C31
MoveFileExW.KERNEL32(003AA710,00000000,00000004), ref: 00366C40
closesocket.WS2_32(?), ref: 00366C60
ExitThread.KERNEL32 ref: 00366C67

Part of subcall function 0036A310: memset.MSVCRT ref: 0036A335
Part of subcall function 0036A310: memset.MSVCRT ref: 0036A34F
Part of subcall function 0036A310: memset.MSVCRT ref: 0036A369
Part of subcall function 0036A310: _vsnprintf.MSVCRT ref: 0036A382
Part of subcall function 0036A310: sprintf.MSVCRT ref: 0036A39A
Part of subcall function 0036A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB,%s.%s,blk,?,?,000001FE,00370A8E), ref: 0036A3AD
Part of subcall function 0036A310: _snprintf.MSVCRT ref: 0036A3CC
Part of subcall function 0036A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB), ref: 0036A3DB
Part of subcall function 0036A310: sprintf.MSVCRT ref: 0036A3EC
Part of subcall function 0036A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A3FB
Part of subcall function 0036A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A404
Part of subcall function 0036A310: EnterCriticalSection.KERNEL32(003AAC34,?,?,00000000), ref: 0036A436
Part of subcall function 0036A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0036A452
Part of subcall function 0036A310: LeaveCriticalSection.KERNEL32(003AAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036A464

Strings

%s:%d, xrefs: 00366AAD, 00366BB2
PRIVMSG, xrefs: 00366B30
%s.Detected process "%S" sending an IRC packet to server %s:%d., xrefs: 00366C0D
PRIVMSG %255s, xrefs: 00366B63
%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s)., xrefs: 00366BF2
block, xrefs: 00366BB7
pdef, xrefs: 00366A8F
JOIN %255s, xrefs: 00366B49
JOIN, xrefs: 00366B1C
cnc, xrefs: 00366AB2

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$memset$File_memicmp$CriticalSectionsprintfsscanf$AttributesCreateEnterExitLeaveMoveThread_snprintf_vsnprintfclosesocket
String ID: %s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).$%s.Detected process "%S" sending an IRC packet to server %s:%d.$%s:%d$JOIN$JOIN %255s$PRIVMSG$PRIVMSG %255s$block$cnc$pdef
API String ID: 1085873876-1467418891
Opcode ID: 7ea626670aec71195430e5b4b59219cb6596a04e0d519a59df40cf0a6cbbc656
Instruction ID: 9f087dbbe22057c7bd61358c46622ab06823b17063583d3f08f272212150ea88
Opcode Fuzzy Hash: 7ea626670aec71195430e5b4b59219cb6596a04e0d519a59df40cf0a6cbbc656
Instruction Fuzzy Hash: 1651E772940204BBDB339F598C87BEE77ACEB44784F54C468F908E7145E7B59980C6A2

Function 00410050 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 135stringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410071
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00410080
lstrlenA.KERNEL32(00000000), ref: 004100AB
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 004100B6
lstrcpyA.KERNEL32(00000000,00000000), ref: 004100CB
lstrlenA.KERNEL32(00000000), ref: 004100D2
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 004100E3
strtok.MSVCRT ref: 004100F9
strstr.MSVCRT ref: 00410117
strstr.MSVCRT ref: 00410129
lstrcatA.KERNEL32(00000000,00412B84), ref: 00410141
_memicmp.MSVCRT ref: 0041014E
lstrcatA.KERNEL32(00000000,Content-Length: ), ref: 00410160
_snprintf.MSVCRT ref: 00410177
lstrcatA.KERNEL32(00000000,00000000), ref: 0041018A
strtok.MSVCRT ref: 00410193
lstrcatA.KERNEL32(00000000,), ref: 004101AB
lstrcatA.KERNEL32(00000000,00000000), ref: 004101B2
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 004101BE

Strings

, xrefs: 004101A5
Content-Length: , xrefs: 00410148, 0041015A

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrcat$Heap$Alloclstrlenstrstrstrtok$FreeProcess_memicmp_snprintflstrcpymemset
String ID: $Content-Length:
API String ID: 4006885983-3599722475
Opcode ID: 930fb4186d5d29aae00d3e8cc07e0d4c77cb9a1f345ff1cca50be87740647e53
Instruction ID: 31871e1923dfa0c5687494671088c66f74ce18a02ae0b8733e53a839020a0827
Opcode Fuzzy Hash: 930fb4186d5d29aae00d3e8cc07e0d4c77cb9a1f345ff1cca50be87740647e53
Instruction Fuzzy Hash: 4A41F671640308BBDB20AF619C45FEF776C9F58715F04411AFE08A6241E7FD9AC18BA9

Function 00370050 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 135stringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00370071
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00370080
lstrlenA.KERNEL32(00000000), ref: 003700AB
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003700B6
lstrcpyA.KERNEL32(00000000,00000000), ref: 003700CB
lstrlenA.KERNEL32(00000000), ref: 003700D2
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003700E3
strtok.MSVCRT ref: 003700F9
strstr.MSVCRT ref: 00370117
strstr.MSVCRT ref: 00370129
lstrcatA.KERNEL32(00000000,00372B84), ref: 00370141
_memicmp.MSVCRT ref: 0037014E
lstrcatA.KERNEL32(00000000,Content-Length: ), ref: 00370160
_snprintf.MSVCRT ref: 00370177
lstrcatA.KERNEL32(00000000,00000000), ref: 0037018A
strtok.MSVCRT ref: 00370193
lstrcatA.KERNEL32(00000000,), ref: 003701AB
lstrcatA.KERNEL32(00000000,00000000), ref: 003701B2
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 003701BE

Strings

, xrefs: 003701A5
Content-Length: , xrefs: 00370148, 0037015A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrcat$Heap$Alloclstrlenstrstrstrtok$FreeProcess_memicmp_snprintflstrcpymemset
String ID: $Content-Length:
API String ID: 4006885983-3599722475
Opcode ID: 785b1f36c3484554cb94478a506b2014c95fc7e3a33d6a27746f1f97760e0a10
Instruction ID: 6b9da164bae029f2740c9dad6040932da04f915576571e331aa645526113dcaa
Opcode Fuzzy Hash: 785b1f36c3484554cb94478a506b2014c95fc7e3a33d6a27746f1f97760e0a10
Instruction Fuzzy Hash: BD41D276600308FBE736AB649C86FEF776C9F54711F418154FD0CAA241E6BC9A818AE1

Function 0040A310 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 127stringfilesleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A335
memset.MSVCRT ref: 0040A34F
memset.MSVCRT ref: 0040A369
_vsnprintf.MSVCRT ref: 0040A382
sprintf.MSVCRT ref: 0040A39A
lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
_snprintf.MSVCRT ref: 0040A3CC
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
sprintf.MSVCRT ref: 0040A3EC
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040A484
CloseHandle.KERNEL32(00000000), ref: 0040A48B
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A496
LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A4A1

Strings

\\.\pipe\%08x_ipc, xrefs: 0040A3BB
30e44aa1, xrefs: 0040A3A8, 0040A3B0, 0040A3FD, 0040A40E
%d., xrefs: 0040A3E6

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$CriticalSectionmemset$FileLeavesprintf$CloseCreateEnterHandleSleepWrite_snprintf_vsnprintf
String ID: %d.$30e44aa1$\\.\pipe\%08x_ipc
API String ID: 4010528547-3602371622
Opcode ID: b5ff21767b458ba7174b6b2b87fc53a5282e9994ed1a393112634c82c948d704
Instruction ID: 8e1fe3b8e3d8ffe6930c52ef9346d3acd19d967879cd91ce29727965d539cad2
Opcode Fuzzy Hash: b5ff21767b458ba7174b6b2b87fc53a5282e9994ed1a393112634c82c948d704
Instruction Fuzzy Hash: 2B41DBB6680318BBD711E7A1DD46FEA732CDF88705F004495F708E60D1DAF85A848B6D

Function 0036A310 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 127stringfilesleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036A335
memset.MSVCRT ref: 0036A34F
memset.MSVCRT ref: 0036A369
_vsnprintf.MSVCRT ref: 0036A382
sprintf.MSVCRT ref: 0036A39A
lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB,%s.%s,blk,?,?,000001FE,00370A8E), ref: 0036A3AD
_snprintf.MSVCRT ref: 0036A3CC
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB), ref: 0036A3DB
sprintf.MSVCRT ref: 0036A3EC
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A3FB
lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A404
EnterCriticalSection.KERNEL32(003AAC34,?,?,00000000), ref: 0036A436
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0036A452
LeaveCriticalSection.KERNEL32(003AAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036A464
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0036A484
CloseHandle.KERNEL32(00000000), ref: 0036A48B
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036A496
LeaveCriticalSection.KERNEL32(003AAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036A4A1

Strings

30e44aa1, xrefs: 0036A3A8, 0036A3B0, 0036A3FD, 0036A40E
\\.\pipe\%08x_ipc, xrefs: 0036A3BB
%d., xrefs: 0036A3E6

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$CriticalSectionmemset$FileLeavesprintf$CloseCreateEnterHandleSleepWrite_snprintf_vsnprintf
String ID: %d.$30e44aa1$\\.\pipe\%08x_ipc
API String ID: 4010528547-3602371622
Opcode ID: cb384aff42950af4482244874d53568bc84263ac0237a7db9b5c0fbe6e956184
Instruction ID: 094304f4de7eb34230010a769aced7d87c4b4ae731eb5822ba881decc654bb99
Opcode Fuzzy Hash: cb384aff42950af4482244874d53568bc84263ac0237a7db9b5c0fbe6e956184
Instruction Fuzzy Hash: D741D9B6540218BBD736E7A4DC86FEA732CDB88711F408494F70CEA0C1DAF46A448B65

Function 004101E0 Relevance: 36.2, APIs: 16, Strings: 8, Instructions: 189memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410202
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00410213
EnterCriticalSection.KERNEL32(0044B4E4), ref: 00410223
strstr.MSVCRT ref: 00410243
lstrlenA.KERNEL32(00000000), ref: 00410254
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0041025F
lstrcpyA.KERNEL32(00000000,00000000), ref: 00410272
strstr.MSVCRT ref: 00410281
_snprintf.MSVCRT ref: 004102C8
strstr.MSVCRT ref: 004102EF
atoi.MSVCRT(00000000,?,http,int), ref: 00410322
lstrlenA.KERNEL32(00000000), ref: 00410386
HeapFree.KERNEL32(?,00000000,00000000), ref: 004103E4
HeapFree.KERNEL32(?,00000000,00000000), ref: 004103EE
LeaveCriticalSection.KERNEL32(0044B4E4), ref: 004103FD
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041041F

Strings

%s.%s hijacked!, xrefs: 004103AD
, xrefs: 0041027B
msg, xrefs: 00410344
int, xrefs: 0041030E
httpspread, xrefs: 004103A8
httpi, xrefs: 00410360
http, xrefs: 00410316, 0041034C
%s=, xrefs: 004102B7

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$Freestrstr$CriticalSectionlstrlen$AllocEnterLeaveProcess_snprintfatoilstrcpymemset
String ID: $%s.%s hijacked!$%s=$http$httpi$httpspread$int$msg
API String ID: 2097228407-1593535274
Opcode ID: ff486f561777821ef5b35251fa65b707b74c89090bba5d12407a9cc2068a4af8
Instruction ID: 6b613a8a9dd3db62d23416ef6319fd59981c507d6a8595e650e32660f9c914f4
Opcode Fuzzy Hash: ff486f561777821ef5b35251fa65b707b74c89090bba5d12407a9cc2068a4af8
Instruction Fuzzy Hash: 6851A771A40319ABDB109BA19C85BFFB778EB44704F14443AFD14A2241DAB8ADD08BAD

Function 003701E0 Relevance: 36.2, APIs: 16, Strings: 8, Instructions: 189memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00370202
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00370213
EnterCriticalSection.KERNEL32(003AB4E4), ref: 00370223
strstr.MSVCRT ref: 00370243
lstrlenA.KERNEL32(00000000), ref: 00370254
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0037025F
lstrcpyA.KERNEL32(00000000,00000000), ref: 00370272
strstr.MSVCRT ref: 00370281
_snprintf.MSVCRT ref: 003702C8
strstr.MSVCRT ref: 003702EF
atoi.MSVCRT(00000000,?,http,int), ref: 00370322
lstrlenA.KERNEL32(00000000), ref: 00370386
HeapFree.KERNEL32(?,00000000,00000000), ref: 003703E4
HeapFree.KERNEL32(?,00000000,00000000), ref: 003703EE
LeaveCriticalSection.KERNEL32(003AB4E4), ref: 003703FD
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0037041F

Strings

httpspread, xrefs: 003703A8
%s=, xrefs: 003702B7
httpi, xrefs: 00370360
, xrefs: 0037027B
%s.%s hijacked!, xrefs: 003703AD
msg, xrefs: 00370344
int, xrefs: 0037030E
http, xrefs: 00370316, 0037034C

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$Freestrstr$CriticalSectionlstrlen$AllocEnterLeaveProcess_snprintfatoilstrcpymemset
String ID: $%s.%s hijacked!$%s=$http$httpi$httpspread$int$msg
API String ID: 2097228407-1593535274
Opcode ID: de2a05e81f1c55a784774adb29724fdc543c08ba84a2788db625b74b946f50ae
Instruction ID: 83c4a7c6c5b6033b952e093220dd5cab71418451650e68d0a07fdf874e67edf2
Opcode Fuzzy Hash: de2a05e81f1c55a784774adb29724fdc543c08ba84a2788db625b74b946f50ae
Instruction Fuzzy Hash: 2251DA76A40615EBEB379B649C45EBFB77CEB44700F04C469F91CA6241DBB8AD008BA0

Function 0040D220 Relevance: 34.7, APIs: 11, Strings: 12, Instructions: 209stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0040D231
strstr.MSVCRT ref: 0040D249
strstr.MSVCRT ref: 0040D25F
strtok.MSVCRT ref: 0040D275
strtok.MSVCRT ref: 0040D297
lstrcmpA.KERNEL32(?,PING), ref: 0040D2C1

Strings

PPPPMSG, xrefs: 0040D37F
332, xrefs: 0040D3D1
PPNG %s, xrefs: 0040D2D1
JOIN, xrefs: 0040D351
WA, xrefs: 0040D2F8, 0040D42B
001, xrefs: 0040D2EC
MOTD, xrefs: 0040D243
PING, xrefs: 0040D2BB
SEND %s %s, xrefs: 0040D308, 0040D43C
433, xrefs: 0040D31D
KCIK %s, xrefs: 0040D33C
376, xrefs: 0040D259

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: strstrstrtok$lstrcmplstrlen
String ID: WA$001$332$376$433$JOIN$KCIK %s$MOTD$PING$PPNG %s$PPPPMSG$SEND %s %s
API String ID: 4048585210-1945936343
Opcode ID: b8cde92cb1254a2a7ae024d0b2fa4488480de74b93d1f53c48958e3b38037d86
Instruction ID: b43457d1463e33dec7e291493da2b720a1f97c649ceaa871d4bac8b1837a23f4
Opcode Fuzzy Hash: b8cde92cb1254a2a7ae024d0b2fa4488480de74b93d1f53c48958e3b38037d86
Instruction Fuzzy Hash: 4651E8B6E4020966D710B669FC42BEA736CDB84719F10817BFC08E2281F67DE85546ED

Function 0036D220 Relevance: 34.7, APIs: 11, Strings: 12, Instructions: 209stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0036D231
strstr.MSVCRT ref: 0036D249
strstr.MSVCRT ref: 0036D25F
strtok.MSVCRT ref: 0036D275
strtok.MSVCRT ref: 0036D297
lstrcmpA.KERNEL32(?,PING), ref: 0036D2C1

Strings

KCIK %s, xrefs: 0036D33C
PING, xrefs: 0036D2BB
433, xrefs: 0036D31D
001, xrefs: 0036D2EC
MOTD, xrefs: 0036D243
376, xrefs: 0036D259
PPPPMSG, xrefs: 0036D37F
PPNG %s, xrefs: 0036D2D1
SEND %s %s, xrefs: 0036D308, 0036D43C
W7, xrefs: 0036D2F8, 0036D42B
332, xrefs: 0036D3D1
JOIN, xrefs: 0036D351

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: strstrstrtok$lstrcmplstrlen
String ID: W7$001$332$376$433$JOIN$KCIK %s$MOTD$PING$PPNG %s$PPPPMSG$SEND %s %s
API String ID: 4048585210-2164369966
Opcode ID: 57b28443d6339407f4bb483d10d5ab8964cf87f8e9a9965947bc74028fcd8489
Instruction ID: 932cc7a2230090d39bbedd9688339fd4891fded00908d606f370be7e0ea6408c
Opcode Fuzzy Hash: 57b28443d6339407f4bb483d10d5ab8964cf87f8e9a9965947bc74028fcd8489
Instruction Fuzzy Hash: E95119B6F4020926D733BA29BC42EAA73ACDB94315F04C565FC0CD6206FA75EC504AE1

Function 0040AE00 Relevance: 34.7, APIs: 23, Instructions: 165stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,00407CC2,00000000,00412914,?,?,?,?,?,?), ref: 0040AE11
HeapAlloc.KERNEL32(?,00000008,00000001,?,00407CC2,00000000,00412914,?,?,?,?,?,?,?,00000000), ref: 0040AE23
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,?,00000000), ref: 0040AE41
strstr.MSVCRT ref: 0040AE59
lstrcpyA.KERNEL32(00000000,?), ref: 0040AE70
lstrcpyA.KERNEL32(00000000,?), ref: 0040AE77
lstrcatA.KERNEL32(00000000,00412B54), ref: 0040AE7F
strtok.MSVCRT ref: 0040AE8E
lstrlenA.KERNEL32(00000000), ref: 0040AEA1
_strnicmp.MSVCRT ref: 0040AEA6
strtok.MSVCRT ref: 0040AEB9
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040AED5
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040AEEB
strstr.MSVCRT ref: 0040AF10
lstrlenA.KERNEL32(00000001), ref: 0040AF20
lstrlenA.KERNEL32(00000001), ref: 0040AF27
??2@YAPAXI@Z.MSVCRT ref: 0040AF2B
lstrlenA.KERNEL32(00000001), ref: 0040AF3D
lstrcpyA.KERNEL32(?,00000001), ref: 0040AF58
lstrlenA.KERNEL32(00000001,?,00000001), ref: 0040AF5F
lstrlenA.KERNEL32(00000001,?,00000001), ref: 0040AF6B
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040AF82
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040AF91

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$Heap$Free$lstrcpy$Allocstrstrstrtok$??2@_strnicmplstrcat
String ID:
API String ID: 3119447416-0
Opcode ID: 90aa6b444a65bc303e4c0c8d939ed632e773fc8290ec026285192ba5a7dd26f4
Instruction ID: 1bbc8982e5118dc887994d25652db9e03b56cb4a90299a9d625484b85630a4b0
Opcode Fuzzy Hash: 90aa6b444a65bc303e4c0c8d939ed632e773fc8290ec026285192ba5a7dd26f4
Instruction Fuzzy Hash: 1F418F75641314BBD7209F65DC81FAB77A8EF49701F14402AFA04A7390DA78ED128BEA

Function 0036AE00 Relevance: 34.7, APIs: 23, Instructions: 165stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,00367CC2,00000000,00372914,?,?,?,?,?,?), ref: 0036AE11
HeapAlloc.KERNEL32(?,00000008,00000001,?,00367CC2,00000000,00372914,?,?,?,?,?,?,?,00000000), ref: 0036AE23
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,?,00000000), ref: 0036AE41
strstr.MSVCRT ref: 0036AE59
lstrcpyA.KERNEL32(00000000,?), ref: 0036AE70
lstrcpyA.KERNEL32(00000000,?), ref: 0036AE77
lstrcatA.KERNEL32(00000000,00372B54), ref: 0036AE7F
strtok.MSVCRT ref: 0036AE8E
lstrlenA.KERNEL32(00000000), ref: 0036AEA1
_strnicmp.MSVCRT ref: 0036AEA6
strtok.MSVCRT ref: 0036AEB9
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036AED5
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036AEEB
strstr.MSVCRT ref: 0036AF10
lstrlenA.KERNEL32(00000001), ref: 0036AF20
lstrlenA.KERNEL32(00000001), ref: 0036AF27
??2@YAPAXI@Z.MSVCRT ref: 0036AF2B
lstrlenA.KERNEL32(00000001), ref: 0036AF3D
lstrcpyA.KERNEL32(?,00000001), ref: 0036AF58
lstrlenA.KERNEL32(00000001,?,00000001), ref: 0036AF5F
lstrlenA.KERNEL32(00000001,?,00000001), ref: 0036AF6B
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036AF82
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036AF91

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$Heap$Free$lstrcpy$Allocstrstrstrtok$??2@_strnicmplstrcat
String ID:
API String ID: 3119447416-0
Opcode ID: c631367499de9199c1341ade7e5faf1fd0dfbb9d18409ba75ce6a88f1c3d6464
Instruction ID: 741f67acc86f9c2dbbcd1f78467e102db1703d48067add52a4b9ba084dd85718
Opcode Fuzzy Hash: c631367499de9199c1341ade7e5faf1fd0dfbb9d18409ba75ce6a88f1c3d6464
Instruction Fuzzy Hash: 88418576600614ABD7229F69DC81F6B77ACEF45710F148018FA08EB240DB75ED01DBE2

Function 00407C00 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 175stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00407C62
_stricmp.MSVCRT(?,cPanel,blog,%s-%s-%s,?,?,00000000), ref: 00407D58
_stricmp.MSVCRT(00000000,WHM), ref: 00407D71
_stricmp.MSVCRT(?,WHCMS), ref: 00407D8A
_stricmp.MSVCRT(?,Directadmin), ref: 00407DA3

Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464

??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00407E02
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 00407E12

Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A

Part of subcall function 00407330: memset.MSVCRT ref: 00407351
Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2

Strings

4)A, xrefs: 00407C75, 00407C81
ffgrab, xrefs: 00407C41
%s.%s ->> %s (%s : %s), xrefs: 00407DEC
%s.%s ->> %s : %s, xrefs: 00407DC4
iegrab, xrefs: 00407C34
WHCMS, xrefs: 00407D84
blog, xrefs: 00407D16, 00407D41
Directadmin, xrefs: 00407D9D
%s-%s-%s, xrefs: 00407D11, 00407D3C
WHM, xrefs: 00407D6B
cPanel, xrefs: 00407D52
httplogin, xrefs: 00407DBF, 00407DE7

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$memset$_stricmp$_snprintf_vsnprintf$??3@CriticalSectionsprintf$CreateEnterFileLeavestrstr
String ID: %s-%s-%s$%s.%s ->> %s (%s : %s)$%s.%s ->> %s : %s$4)A$Directadmin$WHCMS$WHM$blog$cPanel$ffgrab$httplogin$iegrab
API String ID: 3716863481-1807948723
Opcode ID: 8e4f81b2d5485fabb06ec203c6989b96bd99bc9d27faae7ca63cca2e9aaad175
Instruction ID: 7c69c185b85492ea0b4eb43dfbe131e2600de0d92cd53af2a8a27ef6520c0e50
Opcode Fuzzy Hash: 8e4f81b2d5485fabb06ec203c6989b96bd99bc9d27faae7ca63cca2e9aaad175
Instruction Fuzzy Hash: EC5193B4E04215ABEB10DB95DC42EFB736CAF40704B15443FF905A2282E678FD91C6AE

Function 00367C00 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 175stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00367C62
_stricmp.MSVCRT(?,cPanel,blog,%s-%s-%s,?,?,00000000), ref: 00367D58
_stricmp.MSVCRT(00000000,WHM), ref: 00367D71
_stricmp.MSVCRT(?,WHCMS), ref: 00367D8A
_stricmp.MSVCRT(?,Directadmin), ref: 00367DA3

Part of subcall function 0036A310: memset.MSVCRT ref: 0036A335
Part of subcall function 0036A310: memset.MSVCRT ref: 0036A34F
Part of subcall function 0036A310: memset.MSVCRT ref: 0036A369
Part of subcall function 0036A310: _vsnprintf.MSVCRT ref: 0036A382
Part of subcall function 0036A310: sprintf.MSVCRT ref: 0036A39A
Part of subcall function 0036A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB,%s.%s,blk,?,?,000001FE,00370A8E), ref: 0036A3AD
Part of subcall function 0036A310: _snprintf.MSVCRT ref: 0036A3CC
Part of subcall function 0036A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB), ref: 0036A3DB
Part of subcall function 0036A310: sprintf.MSVCRT ref: 0036A3EC
Part of subcall function 0036A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A3FB
Part of subcall function 0036A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A404
Part of subcall function 0036A310: EnterCriticalSection.KERNEL32(003AAC34,?,?,00000000), ref: 0036A436
Part of subcall function 0036A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0036A452
Part of subcall function 0036A310: LeaveCriticalSection.KERNEL32(003AAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036A464

??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00367E02
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 00367E12

Part of subcall function 003673E0: memset.MSVCRT ref: 00367401
Part of subcall function 003673E0: memset.MSVCRT ref: 00367419
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 00367431
Part of subcall function 003673E0: _snprintf.MSVCRT ref: 00367449
Part of subcall function 003673E0: _vsnprintf.MSVCRT ref: 0036746B
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 0036747A

Part of subcall function 00367330: memset.MSVCRT ref: 00367351
Part of subcall function 00367330: lstrlenA.KERNEL32(?), ref: 00367369
Part of subcall function 00367330: _snprintf.MSVCRT ref: 00367381
Part of subcall function 00367330: _vsnprintf.MSVCRT ref: 003673A3
Part of subcall function 00367330: lstrlenA.KERNEL32(00000000), ref: 003673B2

Strings

ffgrab, xrefs: 00367C41
%s.%s ->> %s : %s, xrefs: 00367DC4
4)7, xrefs: 00367C75, 00367C81
WHM, xrefs: 00367D6B
blog, xrefs: 00367D16, 00367D41
iegrab, xrefs: 00367C34
httplogin, xrefs: 00367DBF, 00367DE7
%s-%s-%s, xrefs: 00367D11, 00367D3C
Directadmin, xrefs: 00367D9D
cPanel, xrefs: 00367D52
%s.%s ->> %s (%s : %s), xrefs: 00367DEC
WHCMS, xrefs: 00367D84

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$memset$_stricmp$_snprintf_vsnprintf$??3@CriticalSectionsprintf$CreateEnterFileLeavestrstr
String ID: %s-%s-%s$%s.%s ->> %s (%s : %s)$%s.%s ->> %s : %s$4)7$Directadmin$WHCMS$WHM$blog$cPanel$ffgrab$httplogin$iegrab
API String ID: 3716863481-676380799
Opcode ID: 535b596cd893ffc66ec09648fd66526777b89c669e547febab36ee4814bcaca9
Instruction ID: 1cb93d9b12c2960222ef66e05034ea52ed31e335adf413d4d28e7d2e0034a101
Opcode Fuzzy Hash: 535b596cd893ffc66ec09648fd66526777b89c669e547febab36ee4814bcaca9
Instruction Fuzzy Hash: 2F51E5B5E04619EBDB33DB958C52DBB736CAF40708F44C458F809A6205E675ED41CBA1

Function 004025D0 Relevance: 31.7, APIs: 7, Strings: 14, Instructions: 191stringmemoryCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 0040260F

Part of subcall function 004107D0: lstrlenA.KERNEL32(*&@,?,?,00000000,?,0040262A,?,00417008), ref: 004107DC
Part of subcall function 004107D0: lstrcpyA.KERNEL32(00000000,*&@,?,00417008), ref: 004107F9

strstr.MSVCRT ref: 0040264F

Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747

atoi.MSVCRT(00000000), ref: 004026FB
atoi.MSVCRT(00000000), ref: 00402713
lstrlenA.KERNEL32(00000000), ref: 0040276B
lstrlenA.KERNEL32(00000000,00000000), ref: 0040278C
HeapFree.KERNEL32(?,00000000,00000000), ref: 004027F9

Strings

X-MMS-IM-Format:, xrefs: 00402649
MSG , xrefs: 00402637
msnu, xrefs: 004025EE, 00402660
baddr, xrefs: 004026A8, 004026C3
msn, xrefs: 004027B2, 004027C3, 004027DD
SDG , xrefs: 0040263E
CAL %d %256s, xrefs: 00402609
msnint, xrefs: 004026E0
%s.p10-> Message hijacked!, xrefs: 004027E2
CAL , xrefs: 004025DD
%s.p10-> Message to %s hijacked!, xrefs: 004027C8
msnmsg, xrefs: 00402748
%s.p21-> Message hijacked!, xrefs: 004027B7
MSG , xrefs: 00402672

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$atoi$FreeHeap_snprintflstrcpymemsetsscanfstrstr
String ID: %s.p10-> Message hijacked!$%s.p10-> Message to %s hijacked!$%s.p21-> Message hijacked!$CAL $CAL %d %256s$MSG $MSG $SDG $X-MMS-IM-Format:$baddr$msn$msnint$msnmsg$msnu
API String ID: 1527159713-2027340701
Opcode ID: 1c5d60f0838a4e54170bf3970975cd604f4ddaf8ef4ca16fad64ff7d9a58d065
Instruction ID: cc3cb0c7f7b4e0dd65bdd1dfcfed23b6e80cb0fd4157fe51233a31162f211526
Opcode Fuzzy Hash: 1c5d60f0838a4e54170bf3970975cd604f4ddaf8ef4ca16fad64ff7d9a58d065
Instruction Fuzzy Hash: 0B515775E4020477CB206BA56D86AEF7764AB45714F20847BFD04B33C2E6FD9980869F

Function 003625D0 Relevance: 31.7, APIs: 7, Strings: 14, Instructions: 191stringmemoryCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 0036260F

Part of subcall function 003707D0: lstrlenA.KERNEL32(*&6,?,?,00000000,?,0036262A,?,00377008), ref: 003707DC
Part of subcall function 003707D0: lstrcpyA.KERNEL32(00000000,*&6,?,00377008), ref: 003707F9

strstr.MSVCRT ref: 0036264F

Part of subcall function 00367700: memset.MSVCRT ref: 0036771E
Part of subcall function 00367700: _snprintf.MSVCRT ref: 00367738
Part of subcall function 00367700: lstrlenA.KERNEL32(00000000), ref: 00367747

atoi.MSVCRT(00000000), ref: 003626FB
atoi.MSVCRT(00000000), ref: 00362713
lstrlenA.KERNEL32(00000000), ref: 0036276B
lstrlenA.KERNEL32(00000000,00000000), ref: 0036278C
HeapFree.KERNEL32(?,00000000,00000000), ref: 003627F9

Strings

MSG , xrefs: 00362637
X-MMS-IM-Format:, xrefs: 00362649
msnu, xrefs: 003625EE, 00362660
%s.p10-> Message to %s hijacked!, xrefs: 003627C8
msn, xrefs: 003627B2, 003627C3, 003627DD
baddr, xrefs: 003626A8, 003626C3
msnint, xrefs: 003626E0
CAL %d %256s, xrefs: 00362609
SDG , xrefs: 0036263E
MSG , xrefs: 00362672
%s.p10-> Message hijacked!, xrefs: 003627E2
msnmsg, xrefs: 00362748
%s.p21-> Message hijacked!, xrefs: 003627B7
CAL , xrefs: 003625DD

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$atoi$FreeHeap_snprintflstrcpymemsetsscanfstrstr
String ID: %s.p10-> Message hijacked!$%s.p10-> Message to %s hijacked!$%s.p21-> Message hijacked!$CAL $CAL %d %256s$MSG $MSG $SDG $X-MMS-IM-Format:$baddr$msn$msnint$msnmsg$msnu
API String ID: 1527159713-2027340701
Opcode ID: 1915d2fad71cb37156907ea4dc6ef3850055bbc2ed6a83d47d636cd9b121c0cf
Instruction ID: bb131852047eae81de508fab3d6ee05acb819f20b58e8ecd491b9142b99f412b
Opcode Fuzzy Hash: 1915d2fad71cb37156907ea4dc6ef3850055bbc2ed6a83d47d636cd9b121c0cf
Instruction Fuzzy Hash: 01516B76E40604A7CB336E68AC82DEF77A8DB41711F52C469F80CA6246E6799940CB93

Function 0040EFE0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?), ref: 0040EFF4
memset.MSVCRT ref: 0040F011
memset.MSVCRT ref: 0040F02B
PathFindExtensionA.SHLWAPI(?), ref: 0040F039
lstrcmpA.KERNEL32(00000000), ref: 0040F046
lstrcmpA.KERNEL32(?,004113D8), ref: 0040F056
lstrcmpA.KERNEL32(?,00412FCC), ref: 0040F066
lstrcmpA.KERNEL32(?,RECYCLED), ref: 0040F08F
strrchr.MSVCRT ref: 0040F09C
strrchr.MSVCRT ref: 0040F0A9
_snprintf.MSVCRT ref: 0040F0CC
_snprintf.MSVCRT ref: 0040F0E4
SetFileAttributesA.KERNEL32(?,00000006), ref: 0040F109

Strings

&&%%windir%%\explorer.exe %%cd%%%s, xrefs: 0040F0D3
/c "start %%cd%%RECYCLED\%s, xrefs: 0040F0BB
.lnk, xrefs: 0040F033
RECYCLED, xrefs: 0040F089
%windir%\system32\cmd.exe, xrefs: 0040F0F9

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrcmp$AttributesFile_snprintfmemsetstrrchr$ExtensionFindPath
String ID: %windir%\system32\cmd.exe$&&%%windir%%\explorer.exe %%cd%%%s$.lnk$/c "start %%cd%%RECYCLED\%s$RECYCLED
API String ID: 1691573101-2902080580
Opcode ID: 0b2a0d9fb9959b21254efb4a692907e5e256905912d78335b834429a10a9ba5e
Instruction ID: b7277a1c29d753c849b745b8ec094361e978608dab2ca0d9a5f82dce8da3388c
Opcode Fuzzy Hash: 0b2a0d9fb9959b21254efb4a692907e5e256905912d78335b834429a10a9ba5e
Instruction Fuzzy Hash: 3431C77264431566E730A655DC02FEB726CAF88741F040076FA08B51C2DBFC9D958AB9

Function 0036EFE0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?), ref: 0036EFF4
memset.MSVCRT ref: 0036F011
memset.MSVCRT ref: 0036F02B
PathFindExtensionA.SHLWAPI(?), ref: 0036F039
lstrcmpA.KERNEL32(00000000), ref: 0036F046
lstrcmpA.KERNEL32(?,003713D8), ref: 0036F056
lstrcmpA.KERNEL32(?,00372FCC), ref: 0036F066
lstrcmpA.KERNEL32(?,RECYCLED), ref: 0036F08F
strrchr.MSVCRT ref: 0036F09C
strrchr.MSVCRT ref: 0036F0A9
_snprintf.MSVCRT ref: 0036F0CC
_snprintf.MSVCRT ref: 0036F0E4
SetFileAttributesA.KERNEL32(?,00000006), ref: 0036F109

Strings

.lnk, xrefs: 0036F033
RECYCLED, xrefs: 0036F089
&&%%windir%%\explorer.exe %%cd%%%s, xrefs: 0036F0D3
%windir%\system32\cmd.exe, xrefs: 0036F0F9
/c "start %%cd%%RECYCLED\%s, xrefs: 0036F0BB

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrcmp$AttributesFile_snprintfmemsetstrrchr$ExtensionFindPath
String ID: %windir%\system32\cmd.exe$&&%%windir%%\explorer.exe %%cd%%%s$.lnk$/c "start %%cd%%RECYCLED\%s$RECYCLED
API String ID: 1691573101-2902080580
Opcode ID: cb8ad6721e4d87ec7f39294856003c42afe840920829cfb3b86e003e84590f01
Instruction ID: 1a017a722a6918e891848e6f0bfc1472fcee8fecd363be39be280562f28b78be
Opcode Fuzzy Hash: cb8ad6721e4d87ec7f39294856003c42afe840920829cfb3b86e003e84590f01
Instruction Fuzzy Hash: B631E872640205AAE733F758EC42FEB776CEF49B81F058074FA0CA51C5DBB899418AB1

Function 0040E590 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 141stringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E5B0
EnterCriticalSection.KERNEL32(0044B3C8), ref: 0040E5C9
strtok.MSVCRT ref: 0040E5FE
strstr.MSVCRT ref: 0040E617
strstr.MSVCRT ref: 0040E62D
strstr.MSVCRT ref: 0040E642
lstrlenA.KERNEL32(00000000), ref: 0040E655
lstrlenA.KERNEL32(00000000), ref: 0040E65B
lstrcpyA.KERNEL32(00000000,00411335), ref: 0040E678
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0040E687

Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 0040752B
Part of subcall function 00407500: _snprintf.MSVCRT ref: 00407547
Part of subcall function 00407500: _vsnprintf.MSVCRT ref: 00407569
Part of subcall function 00407500: lstrcmpA.KERNEL32(?,bdns), ref: 0040758B
Part of subcall function 00407500: StrStrIA.SHLWAPI(?,00000000), ref: 0040759F
Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 004075B9

strtok.MSVCRT ref: 0040E6CF
HeapFree.KERNEL32(?,00000000,?), ref: 0040E71E
??3@YAXPAX@Z.MSVCRT(?), ref: 0040E72D
LeaveCriticalSection.KERNEL32(0044B3C8), ref: 0040E73A

Part of subcall function 0040AA10: memset.MSVCRT ref: 0040AA31
Part of subcall function 0040AA10: lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0040AA45
Part of subcall function 0040AA10: InternetOpenA.WININET(00000000,?,?,?,?), ref: 0040AA60
Part of subcall function 0040AA10: lstrlenA.KERNEL32(?), ref: 0040AA78
Part of subcall function 0040AA10: InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0040AA8C

Strings

block, xrefs: 0040E6B7
bdns, xrefs: 0040E699, 0040E6B2
[DNS]: Blocked %d domain(s) - Redirected %d domain(s), xrefs: 0040E6FE

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$strstr$CriticalInternetOpenSectionlstrcpymemsetstrtok$??3@EnterFreeHeapLeave_snprintf_vsnprintflstrcmplstrcpyn
String ID: [DNS]: Blocked %d domain(s) - Redirected %d domain(s)$bdns$block
API String ID: 1940452476-536441337
Opcode ID: 921dcc9b7f1d705da7d3d61043ea9afed801f3cc7dc2e83370c089568948aadd
Instruction ID: 8fc5987a9c18eaf0ca0f86d422a7c70f959c4985efb5a17c84fe55bca5c7fef6
Opcode Fuzzy Hash: 921dcc9b7f1d705da7d3d61043ea9afed801f3cc7dc2e83370c089568948aadd
Instruction Fuzzy Hash: C3412E71E403087BD710A7A69C42DFF7778DB94304F144867FA04F3291E6BD5A9086A9

Function 0036E590 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 141stringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036E5B0
EnterCriticalSection.KERNEL32(003AB3C8), ref: 0036E5C9
strtok.MSVCRT ref: 0036E5FE
strstr.MSVCRT ref: 0036E617
strstr.MSVCRT ref: 0036E62D
strstr.MSVCRT ref: 0036E642
lstrlenA.KERNEL32(00000000), ref: 0036E655
lstrlenA.KERNEL32(00000000), ref: 0036E65B
lstrcpyA.KERNEL32(00000000,00371335), ref: 0036E678
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0036E687

Part of subcall function 00367500: lstrlenA.KERNEL32(?), ref: 0036752B
Part of subcall function 00367500: _snprintf.MSVCRT ref: 00367547
Part of subcall function 00367500: _vsnprintf.MSVCRT ref: 00367569
Part of subcall function 00367500: lstrcmpA.KERNEL32(?,bdns), ref: 0036758B
Part of subcall function 00367500: StrStrIA.SHLWAPI(?,00000000), ref: 0036759F
Part of subcall function 00367500: lstrlenA.KERNEL32(?), ref: 003675B9

strtok.MSVCRT ref: 0036E6CF
HeapFree.KERNEL32(?,00000000,?), ref: 0036E71E
??3@YAXPAX@Z.MSVCRT(?), ref: 0036E72D
LeaveCriticalSection.KERNEL32(003AB3C8), ref: 0036E73A

Part of subcall function 0036AA10: memset.MSVCRT ref: 0036AA31
Part of subcall function 0036AA10: lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0036AA45
Part of subcall function 0036AA10: InternetOpenA.WININET(00000000,?,?,?,?), ref: 0036AA60
Part of subcall function 0036AA10: lstrlenA.KERNEL32(?), ref: 0036AA78
Part of subcall function 0036AA10: InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0036AA8C

Strings

[DNS]: Blocked %d domain(s) - Redirected %d domain(s), xrefs: 0036E6FE
bdns, xrefs: 0036E699, 0036E6B2
block, xrefs: 0036E6B7

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$strstr$CriticalInternetOpenSectionlstrcpymemsetstrtok$??3@EnterFreeHeapLeave_snprintf_vsnprintflstrcmplstrcpyn
String ID: [DNS]: Blocked %d domain(s) - Redirected %d domain(s)$bdns$block
API String ID: 1940452476-536441337
Opcode ID: 3649bb28a49ba9e32fe3ab473c5c6ee2d2af3fdb32f88f25ec2be92d087e65ec
Instruction ID: d74445a59a13708af8c1c81b3c1913895c813fb73a4b4b03a8e372245998d27b
Opcode Fuzzy Hash: 3649bb28a49ba9e32fe3ab473c5c6ee2d2af3fdb32f88f25ec2be92d087e65ec
Instruction Fuzzy Hash: 03411B7A900308BBD733A7A8DC86CEF777CDB94700F148145F90DA6145E6755A44CBA1

Function 00401290 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 146threadCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 004012BE
wcsstr.MSVCRT ref: 004012FD
wcsstr.MSVCRT ref: 00401313
wcsstr.MSVCRT ref: 00401325
SetFileAttributesW.KERNEL32(?,00000080), ref: 00401368
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00401373
ExitThread.KERNEL32 ref: 00401416

Strings

brk, xrefs: 00401383, 0040139A
\\.\pipe, xrefs: 0040130D
ruskill, xrefs: 004013E3
%s.%S, xrefs: 004013E8
dll, xrefs: 0040134C
DBWIN, xrefs: 0040131F
exe, xrefs: 00401335

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Filewcsstr$Attributes$ExitMoveThread
String ID: %s.%S$DBWIN$\\.\pipe$brk$dll$exe$ruskill
API String ID: 294512176-1976196219
Opcode ID: 48d7f3f0eb3b726049e84ec773c3056d91b4342cd67e91c13d54214b385f08ee
Instruction ID: 4833d87296635a158d7d196af6d8583f31ed7f658b3926ae01176550d546c900
Opcode Fuzzy Hash: 48d7f3f0eb3b726049e84ec773c3056d91b4342cd67e91c13d54214b385f08ee
Instruction Fuzzy Hash: 9141F071600309ABE7109F55AC46FDB3358EB48315F14413AFE04A26E1E7789954C6AE

Function 00361290 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 146threadCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 003612BE
wcsstr.MSVCRT ref: 003612FD
wcsstr.MSVCRT ref: 00361313
wcsstr.MSVCRT ref: 00361325
SetFileAttributesW.KERNEL32(?,00000080), ref: 00361368
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00361373
ExitThread.KERNEL32 ref: 00361416

Strings

\\.\pipe, xrefs: 0036130D
%s.%S, xrefs: 003613E8
DBWIN, xrefs: 0036131F
ruskill, xrefs: 003613E3
exe, xrefs: 00361335
dll, xrefs: 0036134C
brk, xrefs: 00361383, 0036139A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Filewcsstr$Attributes$ExitMoveThread
String ID: %s.%S$DBWIN$\\.\pipe$brk$dll$exe$ruskill
API String ID: 294512176-1976196219
Opcode ID: f788c5e29bcaf52ab487673b07dc54bcc2d7b5621d1d5e71b578e585cdede57c
Instruction ID: b187955e1f9bfccfa47cb2fde0fb2d65724cc04978e6b4598bbf58e3d286f999
Opcode Fuzzy Hash: f788c5e29bcaf52ab487673b07dc54bcc2d7b5621d1d5e71b578e585cdede57c
Instruction Fuzzy Hash: 6941257A600605BBE7239F19AC47FEB379CEF18315F19C124FD0896645EB349D40C6A2

Function 0036B300 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 129stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000208), ref: 0036B312
HeapAlloc.KERNEL32(00000000), ref: 0036B319
memset.MSVCRT ref: 0036B339
memset.MSVCRT ref: 0036B354
GetWindowsDirectoryW.KERNEL32(?,00000208), ref: 0036B387
lstrcpynW.KERNEL32(?,?,00000004), ref: 0036B3A1
GetVolumeInformationW.KERNEL32 ref: 0036B3BB
lstrlenA.KERNEL32(30e44aa1), ref: 0036B3D8
lstrlenA.KERNEL32(30e44aa1), ref: 0036B3F0
lstrcatW.KERNEL32(00000000,.exe), ref: 0036B461

Strings

.exe, xrefs: 0036B45B
30e44aa1, xrefs: 0036B3D3, 0036B3EA
lol, xrefs: 0036B371
lol.exe, xrefs: 0036B366

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heaplstrlenmemset$AllocDirectoryInformationProcessVolumeWindowslstrcatlstrcpyn
String ID: .exe$30e44aa1$lol$lol.exe
API String ID: 1748614950-52295467
Opcode ID: dfa20457d5faf30ae882ac48d9361a211796fb0d05f551093680df228f35af0d
Instruction ID: 3bdf4ed0ee7b5877157a778ec6b01f1e64a3144198662757e312d8a7c651285f
Opcode Fuzzy Hash: dfa20457d5faf30ae882ac48d9361a211796fb0d05f551093680df228f35af0d
Instruction Fuzzy Hash: 424109B1601214A6C731CB698C45AEFFBBDEF84311F14C1A6F51CD6251E7B88A80DBA5

Function 0040AA10 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157networkstringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AA31
lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 0040AA45
InternetOpenA.WININET(00000000,?,?,?,?), ref: 0040AA60
lstrlenA.KERNEL32(?), ref: 0040AA78
InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 0040AA8C
HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 0040AAC0
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 0040AAE2
??2@YAPAXI@Z.MSVCRT ref: 0040AB15
InternetReadFile.WININET(00000000,?,00000FF8,00000001), ref: 0040AB67
??2@YAPAXI@Z.MSVCRT ref: 0040AB85
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040ABA5
InternetCloseHandle.WININET(00000000), ref: 0040ABE7

Strings

Mozilla/4.0, xrefs: 0040AA39

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Internet$??2@OpenQuery$??3@AvailableCloseDataFileHandleHttpInfoReadlstrcpylstrlenmemset
String ID: Mozilla/4.0
API String ID: 2392773942-2634101963
Opcode ID: 4f10962397f0d9271c525f08f7cb6bc530c7be40262e652ad9c0884eaf464376
Instruction ID: a422d9b20280b57269b7f944718ccc37572e3d881d969e5d12542f5013b1ac47
Opcode Fuzzy Hash: 4f10962397f0d9271c525f08f7cb6bc530c7be40262e652ad9c0884eaf464376
Instruction Fuzzy Hash: AA519D75A00205AFD720DF59EC84FAA77F8EB49300F14847EE908E7290D7B4A955CF99

Function 0040EE40 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142stringcomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00413634,00000000,00000001,00413614,?), ref: 0040EE5B
memset.MSVCRT ref: 0040EE81
lstrcpyA.KERNEL32(00000000,?), ref: 0040EE9A
lstrcatA.KERNEL32(00000000,00412C78), ref: 0040EEAE
lstrcatA.KERNEL32(00000000,?), ref: 0040EEBB
memset.MSVCRT ref: 0040EED5
SHGetFileInfoA.SHELL32(?,00000000,00000000,00000160,00001000), ref: 0040EEF4
memset.MSVCRT ref: 0040EF68
lstrcpyA.KERNEL32(00000000,?), ref: 0040EF7B
lstrcatA.KERNEL32(00000000,.lnk), ref: 0040EF89
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0040EFA4

Strings

shell32.dll, xrefs: 0040EF25
.lnk, xrefs: 0040EF7D

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrcatmemset$lstrcpy$ByteCharCreateFileInfoInstanceMultiWide
String ID: .lnk$shell32.dll
API String ID: 3196525290-3399515747
Opcode ID: a40b82f81dedbe41e5b5f199d7865c4fa3311a6b57336a6c214b4744f9a9312f
Instruction ID: e73eb6ab999c0e51fafbce32c2bf391fc0f26170288299265a72334d30c84f39
Opcode Fuzzy Hash: a40b82f81dedbe41e5b5f199d7865c4fa3311a6b57336a6c214b4744f9a9312f
Instruction Fuzzy Hash: 3E513375A40208BFDB50DB94CC85FDAB3B9AF8C704F104599F608E7290D7B4AE85CB64

Function 00402220 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00402243
WSAStartup.WS2_32(00000202,?), ref: 00402257

Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313

htons.WS2_32(00000050), ref: 00402288
socket.WS2_32(00000002,00000001,00000006), ref: 00402297
connect.WS2_32(00000000,?,00000010), ref: 004022AE
GetTickCount.KERNEL32 ref: 004022C3
GetTickCount.KERNEL32 ref: 004022F4
GetTickCount.KERNEL32 ref: 00402307
send.WS2_32(00000000,00000000,00000400,00000000), ref: 00402344
GetTickCount.KERNEL32 ref: 00402350
closesocket.WS2_32(00000000), ref: 00402363

Strings

i.root-servers.org, xrefs: 00402264
gfff, xrefs: 00402379

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CountTick$Startupclosesocketconnectgethostbynamehtonsinet_addrmemsetsendsocket
String ID: gfff$i.root-servers.org
API String ID: 99835129-3534201491
Opcode ID: f78e395c58b77124e21493b2d3d67db5c73849f44d2ec07c99d54a6843a9ec4a
Instruction ID: 99d350245f41469f9620f1c84c2ac9dacd51c4893e9af8f4a97e645d4d05bf82
Opcode Fuzzy Hash: f78e395c58b77124e21493b2d3d67db5c73849f44d2ec07c99d54a6843a9ec4a
Instruction Fuzzy Hash: 20312872B0031857DB14E67A9D46BEFA2698B85714F04457AFE0CE72C0EAF88D81469A

Function 00362220 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00362243
WSAStartup.WS2_32(00000202,?), ref: 00362257

Part of subcall function 00369300: inet_addr.WS2_32(n"6), ref: 00369308
Part of subcall function 00369300: gethostbyname.WS2_32(n"6), ref: 00369313

htons.WS2_32(00000050), ref: 00362288
socket.WS2_32(00000002,00000001,00000006), ref: 00362297
connect.WS2_32(00000000,?,00000010), ref: 003622AE
GetTickCount.KERNEL32 ref: 003622C3
GetTickCount.KERNEL32 ref: 003622F4
GetTickCount.KERNEL32 ref: 00362307
send.WS2_32(00000000,00000000,00000400,00000000), ref: 00362344
GetTickCount.KERNEL32 ref: 00362350
closesocket.WS2_32(00000000), ref: 00362363

Strings

i.root-servers.org, xrefs: 00362264
gfff, xrefs: 00362379

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CountTick$Startupclosesocketconnectgethostbynamehtonsinet_addrmemsetsendsocket
String ID: gfff$i.root-servers.org
API String ID: 99835129-3534201491
Opcode ID: 41296caac908b04ec27c6eed035764c6a908eaf67deeb2b9fcea845dc3ccd9e0
Instruction ID: 168749357e4ea4c866ba99e5d19f48743618ae037dc388d7cd939bde22e32ba4
Opcode Fuzzy Hash: 41296caac908b04ec27c6eed035764c6a908eaf67deeb2b9fcea845dc3ccd9e0
Instruction Fuzzy Hash: 06318AB2B002085BDB2AD66D9C42BFFB26D8F84700F158525FA0CEB3C4EAB48D0147D2

Function 00409830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409850
strtok.MSVCRT ref: 0040986E
HeapFree.KERNEL32(?,00000000,?), ref: 0040988B
lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 004098A8
strtok.MSVCRT ref: 004098B5
HeapFree.KERNEL32(?,00000000,?), ref: 004098D1
HeapFree.KERNEL32(?,00000000,?), ref: 0040999C

Strings

[UDP]: Starting flood on "%s:%d" for %d second(s), xrefs: 0040993A
[UDP]: Finished flood on "%s:%d", xrefs: 00409970

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: FreeHeap$strtok$lstrcpynmemset
String ID: [UDP]: Finished flood on "%s:%d"$[UDP]: Starting flood on "%s:%d" for %d second(s)
API String ID: 216847750-2644890838
Opcode ID: 54cb3ea3974434cd071d8694b67c6c8d9e1e54e687e6a1fad61b000ba8bb3522
Instruction ID: fbb45061dfc7ed30b2521fa6da11e7ac7608b88c8cddc2238a61025220eaa290
Opcode Fuzzy Hash: 54cb3ea3974434cd071d8694b67c6c8d9e1e54e687e6a1fad61b000ba8bb3522
Instruction Fuzzy Hash: A531DCF26442086BD720A7A1AC46FE7375CDB84709F04417EFF08E12D1D5B99D5087AD

Function 004096B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004096D0
strtok.MSVCRT ref: 004096EE
HeapFree.KERNEL32(?,00000000,?), ref: 0040970B
lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 00409728
strtok.MSVCRT ref: 00409735
HeapFree.KERNEL32(?,00000000,?), ref: 00409751
HeapFree.KERNEL32(?,00000000,?), ref: 0040981C

Strings

[SYN]: Starting flood on "%s:%d" for %d second(s), xrefs: 004097BA
[SYN]: Finished flood on "%s:%d", xrefs: 004097F0

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: FreeHeap$strtok$lstrcpynmemset
String ID: [SYN]: Finished flood on "%s:%d"$[SYN]: Starting flood on "%s:%d" for %d second(s)
API String ID: 216847750-3475151101
Opcode ID: fb129c0162ccbfb104049f26340d41eef2b7c7d60fa9300f04f63c344587d033
Instruction ID: bdd8c48b6cfbaf6ae2aa7db1173a1b009192250db3acf329e7d18af35a504bf2
Opcode Fuzzy Hash: fb129c0162ccbfb104049f26340d41eef2b7c7d60fa9300f04f63c344587d033
Instruction Fuzzy Hash: B631E9F2A50204ABD720A7A1AC46FE7375CDB45309F14847AFF08A22D2D6B89D5087AD

Function 00369830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00369850
strtok.MSVCRT ref: 0036986E
HeapFree.KERNEL32(?,00000000,?), ref: 0036988B
lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 003698A8
strtok.MSVCRT ref: 003698B5
HeapFree.KERNEL32(?,00000000,?), ref: 003698D1
HeapFree.KERNEL32(?,00000000,?), ref: 0036999C

Strings

[UDP]: Finished flood on "%s:%d", xrefs: 00369970
[UDP]: Starting flood on "%s:%d" for %d second(s), xrefs: 0036993A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: FreeHeap$strtok$lstrcpynmemset
String ID: [UDP]: Finished flood on "%s:%d"$[UDP]: Starting flood on "%s:%d" for %d second(s)
API String ID: 216847750-2644890838
Opcode ID: 67748c10eb3aafae285d101781178b5456bd131ca9f8a95a620331c26ac8dd4f
Instruction ID: 2a2517291a79f91d872ffde8c7b64008c259628d3bb94bc4a87f7d068eeb5756
Opcode Fuzzy Hash: 67748c10eb3aafae285d101781178b5456bd131ca9f8a95a620331c26ac8dd4f
Instruction Fuzzy Hash: 393116B3A002086BD732A7A5AC46FBB339CEB45314F04816DFA0CE6145D7B59940C662

Function 003696B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003696D0
strtok.MSVCRT ref: 003696EE
HeapFree.KERNEL32(?,00000000,?), ref: 0036970B
lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 00369728
strtok.MSVCRT ref: 00369735
HeapFree.KERNEL32(?,00000000,?), ref: 00369751
HeapFree.KERNEL32(?,00000000,?), ref: 0036981C

Strings

[SYN]: Finished flood on "%s:%d", xrefs: 003697F0
[SYN]: Starting flood on "%s:%d" for %d second(s), xrefs: 003697BA

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: FreeHeap$strtok$lstrcpynmemset
String ID: [SYN]: Finished flood on "%s:%d"$[SYN]: Starting flood on "%s:%d" for %d second(s)
API String ID: 216847750-3475151101
Opcode ID: 5bca53f8a622adcba29b14372bc0fabf784a352e008e4812b52047f7ac8d932d
Instruction ID: f52d8f6bc08120ca277589ea4572c73b0ce59ac4dbb30f38729a648466147f12
Opcode Fuzzy Hash: 5bca53f8a622adcba29b14372bc0fabf784a352e008e4812b52047f7ac8d932d
Instruction Fuzzy Hash: 193109F39002086BE736ABA0AC46FB7335CEB45314F048069FF0CDA185D6B59D44C7A5

Function 00410C80 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00410C89
GetModuleFileNameA.KERNEL32(00000000,0044AA28,00000104), ref: 00410C9F
GetModuleFileNameW.KERNEL32(00000000,0044A710,00000208), ref: 00410CB0
GetWindowsDirectoryA.KERNEL32(0044AB30,00000104), ref: 00410CC0

Part of subcall function 004019F0: wcsrchr.MSVCRT ref: 004019F9

InitializeCriticalSection.KERNEL32(0044AC34), ref: 00410CE3
InitializeCriticalSection.KERNEL32(0044B4E4), ref: 00410CEA
MoveFileExW.KERNEL32(0044A710,00000000,00000004), ref: 00410DA5

Part of subcall function 0040A150: memset.MSVCRT ref: 0040A170
Part of subcall function 0040A150: GetWindowsDirectoryW.KERNEL32(?,00000208,?,?,?), ref: 0040A184
Part of subcall function 0040A150: _memicmp.MSVCRT ref: 0040A1C3

SetFileAttributesW.KERNEL32(0044A710,00000080), ref: 00410D96
CreateThread.KERNEL32(00000000,00000000,Function_0000E9F0,00000000,00000000,00000000), ref: 00410DED
CloseHandle.KERNEL32(00000000), ref: 00410DF4

Strings

brk, xrefs: 00410D57, 00410D72
ruskill, xrefs: 00410DB4
%s.%S, xrefs: 00410DB9

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: File$CriticalDirectoryInitializeModuleNameSectionWindows$AttributesCloseCreateHandleHeapMoveProcessThread_memicmpmemsetwcsrchr
String ID: %s.%S$brk$ruskill
API String ID: 2870590860-2269373653
Opcode ID: f3ac461219e4e0abdf8921ca99c1299e94cb7a3db5c5f1741129b7d9564e1414
Instruction ID: 3a2e178202fb7a30b488f4e8e7deeec61a3289b4e305d2c307b23111bd812d03
Opcode Fuzzy Hash: f3ac461219e4e0abdf8921ca99c1299e94cb7a3db5c5f1741129b7d9564e1414
Instruction Fuzzy Hash: E031B471AC0310B7F3306BA1AD0BFCA76A4A709B05F204037FB01A56E1D6FCA0A1865F

Function 00370C80 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00370C89
GetModuleFileNameA.KERNEL32(00000000,003AAA28,00000104), ref: 00370C9F
GetModuleFileNameW.KERNEL32(00000000,003AA710,00000208), ref: 00370CB0
GetWindowsDirectoryA.KERNEL32(003AAB30,00000104), ref: 00370CC0

Part of subcall function 003619F0: wcsrchr.MSVCRT ref: 003619F9

InitializeCriticalSection.KERNEL32(003AAC34), ref: 00370CE3
InitializeCriticalSection.KERNEL32(003AB4E4), ref: 00370CEA
MoveFileExW.KERNEL32(003AA710,00000000,00000004), ref: 00370DA5

Part of subcall function 0036A150: memset.MSVCRT ref: 0036A170
Part of subcall function 0036A150: GetWindowsDirectoryW.KERNEL32(?,00000208,?,?,?), ref: 0036A184
Part of subcall function 0036A150: _memicmp.MSVCRT ref: 0036A1C3

SetFileAttributesW.KERNEL32(003AA710,00000080), ref: 00370D96
CreateThread.KERNEL32(00000000,00000000,Function_0000E9F0,00000000,00000000,00000000), ref: 00370DED
CloseHandle.KERNEL32(00000000), ref: 00370DF4

Strings

%s.%S, xrefs: 00370DB9
ruskill, xrefs: 00370DB4
brk, xrefs: 00370D57, 00370D72

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: File$CriticalDirectoryInitializeModuleNameSectionWindows$AttributesCloseCreateHandleHeapMoveProcessThread_memicmpmemsetwcsrchr
String ID: %s.%S$brk$ruskill
API String ID: 2870590860-2269373653
Opcode ID: d3d4774cd5fe6536c05857de092ead06c58ce774df08f44a19b5e9d4c099d2f2
Instruction ID: 8d229ad3e332f3e05943fb172163844475a3f158018546aa31944a6293b0faec
Opcode Fuzzy Hash: d3d4774cd5fe6536c05857de092ead06c58ce774df08f44a19b5e9d4c099d2f2
Instruction Fuzzy Hash: E431C7776C0700FBE63357E46C07FAA37E8EB06B45F008020F649A91E2DBA56051CA67

Function 0040A880 Relevance: 22.6, APIs: 2, Strings: 13, Instructions: 60COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A89E

Part of subcall function 00407790: memset.MSVCRT ref: 004077AE
Part of subcall function 00407790: memset.MSVCRT ref: 004077C8
Part of subcall function 00407790: lstrcpyA.KERNEL32(00000000,off), ref: 004077F0
Part of subcall function 00407790: _snprintf.MSVCRT ref: 0040780D
Part of subcall function 00407790: lstrlenA.KERNEL32(00000000), ref: 00407822
Part of subcall function 00407790: lstrlenA.KERNEL32(00000000), ref: 00407858

_snprintf.MSVCRT ref: 0040A936

Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 0040752B
Part of subcall function 00407500: _snprintf.MSVCRT ref: 00407547
Part of subcall function 00407500: _vsnprintf.MSVCRT ref: 00407569
Part of subcall function 00407500: lstrcmpA.KERNEL32(?,bdns), ref: 0040758B
Part of subcall function 00407500: StrStrIA.SHLWAPI(?,00000000), ref: 0040759F
Part of subcall function 00407500: lstrlenA.KERNEL32(?), ref: 004075B9

Strings

ftpgrab, xrefs: 0040A8E1
usbi, xrefs: 0040A908
msg, xrefs: 0040A951
bdns, xrefs: 0040A8FC
pdef, xrefs: 0040A8BD
msnu, xrefs: 0040A8B1
popgrab, xrefs: 0040A8ED
ffgrab, xrefs: 0040A8C9
int, xrefs: 0040A93B
iegrab, xrefs: 0040A8D5
httpi, xrefs: 0040A914
msn, xrefs: 0040A8A5
http, xrefs: 0040A946, 0040A956

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$_snprintfmemset$_vsnprintflstrcmplstrcpy
String ID: bdns$ffgrab$ftpgrab$http$httpi$iegrab$int$msg$msn$msnu$pdef$popgrab$usbi
API String ID: 3955240783-2907616027
Opcode ID: 699ddea0ae8c647cc20d7a969bd25affe5c253e482046ec1477590fe2f3617ef
Instruction ID: 457c04c965f4f402ec546b575a89d7806f30f9b4e57064c7f721fde9d0d55c32
Opcode Fuzzy Hash: 699ddea0ae8c647cc20d7a969bd25affe5c253e482046ec1477590fe2f3617ef
Instruction Fuzzy Hash: 3211CC74FE930675E660BBA25D83FD962254B40F48F20046B7618BA0D799FD35D0826F

Function 0036A880 Relevance: 22.6, APIs: 2, Strings: 13, Instructions: 60COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036A89E

Part of subcall function 00367790: memset.MSVCRT ref: 003677AE
Part of subcall function 00367790: memset.MSVCRT ref: 003677C8
Part of subcall function 00367790: lstrcpyA.KERNEL32(00000000,off), ref: 003677F0
Part of subcall function 00367790: _snprintf.MSVCRT ref: 0036780D
Part of subcall function 00367790: lstrlenA.KERNEL32(00000000), ref: 00367822
Part of subcall function 00367790: lstrlenA.KERNEL32(00000000), ref: 00367858

_snprintf.MSVCRT ref: 0036A936

Part of subcall function 00367500: lstrlenA.KERNEL32(?), ref: 0036752B
Part of subcall function 00367500: _snprintf.MSVCRT ref: 00367547
Part of subcall function 00367500: _vsnprintf.MSVCRT ref: 00367569
Part of subcall function 00367500: lstrcmpA.KERNEL32(?,bdns), ref: 0036758B
Part of subcall function 00367500: StrStrIA.SHLWAPI(?,00000000), ref: 0036759F
Part of subcall function 00367500: lstrlenA.KERNEL32(?), ref: 003675B9

Strings

ffgrab, xrefs: 0036A8C9
ftpgrab, xrefs: 0036A8E1
bdns, xrefs: 0036A8FC
msn, xrefs: 0036A8A5
int, xrefs: 0036A93B
msnu, xrefs: 0036A8B1
usbi, xrefs: 0036A908
pdef, xrefs: 0036A8BD
httpi, xrefs: 0036A914
iegrab, xrefs: 0036A8D5
msg, xrefs: 0036A951
popgrab, xrefs: 0036A8ED
http, xrefs: 0036A946, 0036A956

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$_snprintfmemset$_vsnprintflstrcmplstrcpy
String ID: bdns$ffgrab$ftpgrab$http$httpi$iegrab$int$msg$msn$msnu$pdef$popgrab$usbi
API String ID: 3955240783-2907616027
Opcode ID: 11d1262e98bdbd6567669483a9e7cbc78ea7c2849cd61c67483422eae3c20273
Instruction ID: 357a8f2956e236ce0aaf1df97ffae4238040f398d631fa3367d96cd1f0ce76a7
Opcode Fuzzy Hash: 11d1262e98bdbd6567669483a9e7cbc78ea7c2849cd61c67483422eae3c20273
Instruction Fuzzy Hash: CF115275BF930A75FA77B6A44CC3FEA22594B40F08F40C094F20DBD0C6A9E925408266

Function 004017E0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040180E
memset.MSVCRT ref: 00401829
wcsstr.MSVCRT ref: 00401842
lstrcmpA.KERNEL32(00000000,block), ref: 00401888
strstr.MSVCRT ref: 00401898
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000208), ref: 004018B7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 00401905

Strings

block, xrefs: 00401882
brk, xrefs: 00401998, 004019AF
bdns, xrefs: 0040185B, 00401922
%s.%S, xrefs: 004019BF
rdns, xrefs: 004019BA

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ByteCharMultiWidememset$lstrcmpstrstrwcsstr
String ID: %s.%S$bdns$block$brk$rdns
API String ID: 695720605-4000218262
Opcode ID: 9e954df8ccb3bb30851bf74f7e6fcbbb0a11fed6d0820c81aa3748fd1c2c191f
Instruction ID: 328a3583c6fef178050e9a0b2bf86a627fd064549297ff0a8097fc8f98231c6a
Opcode Fuzzy Hash: 9e954df8ccb3bb30851bf74f7e6fcbbb0a11fed6d0820c81aa3748fd1c2c191f
Instruction Fuzzy Hash: F9511CB1A0020877EB20EB55DC46FDB77689B45715F10413BFD14B22E1D7B8DA84C7AA

Function 003617E0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036180E
memset.MSVCRT ref: 00361829
wcsstr.MSVCRT ref: 00361842
lstrcmpA.KERNEL32(00000000,block), ref: 00361888
strstr.MSVCRT ref: 00361898
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000208), ref: 003618B7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 00361905

Strings

%s.%S, xrefs: 003619BF
bdns, xrefs: 0036185B, 00361922
rdns, xrefs: 003619BA
block, xrefs: 00361882
brk, xrefs: 00361998, 003619AF

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ByteCharMultiWidememset$lstrcmpstrstrwcsstr
String ID: %s.%S$bdns$block$brk$rdns
API String ID: 695720605-4000218262
Opcode ID: dfbd5013c6e539dd824b9a24c3959a34b3ff201e6a0d4fdfe36343a184e631af
Instruction ID: e22beee7b04eca816cb5d4be7fb2c114da0d153143c6c6f3712bc8c3e9587b53
Opcode Fuzzy Hash: dfbd5013c6e539dd824b9a24c3959a34b3ff201e6a0d4fdfe36343a184e631af
Instruction Fuzzy Hash: 75510776A00204BBEB33DB58DC46FEB37AC9B46700F04C159F908A6185E7B4DA44CBE2

Function 004010A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 102stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004010C0
lstrcmpW.KERNEL32(?,0044ADA0), ref: 004010D7
lstrcmpW.KERNEL32(?,0044A710), ref: 0040111D
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00401127
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 00401161
lstrcpyA.KERNEL32(00416D88,00000000), ref: 00401179
lstrcpyA.KERNEL32(00000000,00411335), ref: 00401187
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 004011A0
lstrcpyA.KERNEL32(00416E90,00000000), ref: 004011B3

Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747

Strings

ruskill, xrefs: 00401132
pdef, xrefs: 004010DD
%s.%S, xrefs: 00401137

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrcpy$ByteCharMultiWidelstrcmpmemset$FileMove_snprintflstrlen
String ID: %s.%S$pdef$ruskill
API String ID: 1230166232-1410347113
Opcode ID: 51cd4f5fa0b6c86073725b4143443cb2e09f91004ad57c90408242329a01e057
Instruction ID: 68c4e51678c4734124622e75f1a3a1355b75001ea3a3ec5cf96f04565ba1ff23
Opcode Fuzzy Hash: 51cd4f5fa0b6c86073725b4143443cb2e09f91004ad57c90408242329a01e057
Instruction Fuzzy Hash: 6C3106B17403187BE7209B559C82FEB736C9B89B10F104167FB54B62D0D6F4ED80866D

Function 003610A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 102stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003610C0
lstrcmpW.KERNEL32(?,003AADA0), ref: 003610D7
lstrcmpW.KERNEL32(?,003AA710), ref: 0036111D
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00361127
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 00361161
lstrcpyA.KERNEL32(00376D88,00000000), ref: 00361179
lstrcpyA.KERNEL32(00000000,00371335), ref: 00361187
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 003611A0
lstrcpyA.KERNEL32(00376E90,00000000), ref: 003611B3

Part of subcall function 00367700: memset.MSVCRT ref: 0036771E
Part of subcall function 00367700: _snprintf.MSVCRT ref: 00367738
Part of subcall function 00367700: lstrlenA.KERNEL32(00000000), ref: 00367747

Strings

%s.%S, xrefs: 00361137
ruskill, xrefs: 00361132
pdef, xrefs: 003610DD

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrcpy$ByteCharMultiWidelstrcmpmemset$FileMove_snprintflstrlen
String ID: %s.%S$pdef$ruskill
API String ID: 1230166232-1410347113
Opcode ID: 026796b3398e48b2c7459e421fa4b673d99b30e0795f54399508c3a6eccdecdb
Instruction ID: 9d6444960be679eb6122ead5cea05bd00bc0396b9c6d29d9cc57b329a63771c6
Opcode Fuzzy Hash: 026796b3398e48b2c7459e421fa4b673d99b30e0795f54399508c3a6eccdecdb
Instruction Fuzzy Hash: 7931B6B67403157BE7329B589C86FEA736CDB4AB10F048155FB48AA1C4D7F0AD80C675

Function 004073E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407401
memset.MSVCRT ref: 00407419
lstrlenA.KERNEL32(?), ref: 00407431
_snprintf.MSVCRT ref: 00407449
_vsnprintf.MSVCRT ref: 0040746B
lstrlenA.KERNEL32(?), ref: 0040747A
_memicmp.MSVCRT ref: 004074B0
_vsnprintf.MSVCRT ref: 004074D0

Strings

block, xrefs: 004074AA
%s_, xrefs: 00407438
blk, xrefs: 004074DC
%s.%s, xrefs: 004074E1

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: _vsnprintflstrlenmemset$_memicmp_snprintf
String ID: %s.%s$%s_$blk$block
API String ID: 3657324510-3589362310
Opcode ID: 9ce3c90b2ddbd0b13b32ba395e9eecb039a435e54ac3256a86e0091f5d7442f1
Instruction ID: e3d0b4f69a4c5134c0a3218338a603e019a2a9bfe2e8293b1a871985f276413f
Opcode Fuzzy Hash: 9ce3c90b2ddbd0b13b32ba395e9eecb039a435e54ac3256a86e0091f5d7442f1
Instruction Fuzzy Hash: EE2132B294031D7AE710EB59DC82FFB336CDB44708F4445BEBB0893182E5789E854769

Function 003673E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00367401
memset.MSVCRT ref: 00367419
lstrlenA.KERNEL32(?), ref: 00367431
_snprintf.MSVCRT ref: 00367449
_vsnprintf.MSVCRT ref: 0036746B
lstrlenA.KERNEL32(?), ref: 0036747A
_memicmp.MSVCRT ref: 003674B0
_vsnprintf.MSVCRT ref: 003674D0

Strings

%s.%s, xrefs: 003674E1
blk, xrefs: 003674DC
%s_, xrefs: 00367438
block, xrefs: 003674AA

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: _vsnprintflstrlenmemset$_memicmp_snprintf
String ID: %s.%s$%s_$blk$block
API String ID: 3657324510-3589362310
Opcode ID: 8ec815edb3d7ef0f5650a5b99d74dfb188bacf20701c102f680c0e481b745799
Instruction ID: 78c4405644adff30dfdb7592f11d1775d1ca0444fa21cc2ba795f0e9b637c2f6
Opcode Fuzzy Hash: 8ec815edb3d7ef0f5650a5b99d74dfb188bacf20701c102f680c0e481b745799
Instruction Fuzzy Hash: F0213FB694020D7AE722EA59DC82FFB33ACDB44714F44C5A8FA0CA7141EA749E4547A0

Function 00409580 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004095A4
memset.MSVCRT ref: 004095BE
memset.MSVCRT ref: 004095D8
GetTickCount.KERNEL32 ref: 004095E0
lstrcpyA.KERNEL32(?,Mozilla/4.0), ref: 00409611
lstrcpyA.KERNEL32(?,GET), ref: 00409664
sprintf.MSVCRT ref: 00409685
strtok.MSVCRT ref: 00409696

Strings

POST, xrefs: 0040963C, 0040964A
Mozilla/4.0, xrefs: 00409602
%s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42, xrefs: 0040967F
GET, xrefs: 00409658

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: memset$lstrcpy$CountTicksprintfstrtok
String ID: %s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42$GET$Mozilla/4.0$POST
API String ID: 3318893083-109246470
Opcode ID: ab8c1bc6b042fd2f554f543c151083597909fae3e40bddd3ea1445c51ee56114
Instruction ID: a58238f94dc203fc7a4291ccda806a9fd0a954f169f11a3db57d908f1604fe94
Opcode Fuzzy Hash: ab8c1bc6b042fd2f554f543c151083597909fae3e40bddd3ea1445c51ee56114
Instruction Fuzzy Hash: 06212DF29402186AC714E769CD42FDA736C9BA8704F00459BF308B21C1D6F8AFC48A6C

Function 00369580 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003695A4
memset.MSVCRT ref: 003695BE
memset.MSVCRT ref: 003695D8
GetTickCount.KERNEL32 ref: 003695E0
lstrcpyA.KERNEL32(?,Mozilla/4.0), ref: 00369611
lstrcpyA.KERNEL32(?,GET), ref: 00369664
sprintf.MSVCRT ref: 00369685
strtok.MSVCRT ref: 00369696

Strings

%s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42, xrefs: 0036967F
POST, xrefs: 0036963C, 0036964A
Mozilla/4.0, xrefs: 00369602
GET, xrefs: 00369658

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: memset$lstrcpy$CountTicksprintfstrtok
String ID: %s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42$GET$Mozilla/4.0$POST
API String ID: 3318893083-109246470
Opcode ID: b08fe21d9414c3fcabf9b8713482819aac44f78b313de411a617f3f36387d9ac
Instruction ID: 46f88dac0910a650fb4a8c36ef33eec2eac0c80e771e804df30f6ccca82bcf18
Opcode Fuzzy Hash: b08fe21d9414c3fcabf9b8713482819aac44f78b313de411a617f3f36387d9ac
Instruction Fuzzy Hash: 58212EB69402186AD73BD764CC86FEA736C9FA9710F04C585F30DA6085D6F4ABC48B61

Function 00408270 Relevance: 19.8, APIs: 13, Instructions: 305COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408292
GetTickCount.KERNEL32 ref: 004082A8

Part of subcall function 004081C0: WSAStartup.WS2_32(00000202,?), ref: 004081E3

select.WS2_32(00000000,00000000,?,00000000,?), ref: 00408314

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CountTick$Startupselect
String ID:
API String ID: 3882035529-0
Opcode ID: 85fd59747fc3b1c661cce8175a3d351750ef0b52ceea1d2a7c6e5893856a6c4a
Instruction ID: 4b61705fb868fa9baa08715d210e5fb779858df6dc90d303a1a16509d1b594dd
Opcode Fuzzy Hash: 85fd59747fc3b1c661cce8175a3d351750ef0b52ceea1d2a7c6e5893856a6c4a
Instruction Fuzzy Hash: 62A1DBB1900604ABC734DF69D981AEBB7E8EF44314F00492FE68D97281E779A9818B95

Function 00368270 Relevance: 19.8, APIs: 13, Instructions: 305COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00368292
GetTickCount.KERNEL32 ref: 003682A8

Part of subcall function 003681C0: WSAStartup.WS2_32(00000202,?), ref: 003681E3

select.WS2_32(00000000,00000000,?,00000000,?), ref: 00368314

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CountTick$Startupselect
String ID:
API String ID: 3882035529-0
Opcode ID: 67d605d7d4f21b641fd4e26498f51e5d61285701a36c3e7f5d9f37b875a8d93e
Instruction ID: 6bd779b523b20719365a77ca8c76f6c65e202ba8e446b0596368e3e5b2702e20
Opcode Fuzzy Hash: 67d605d7d4f21b641fd4e26498f51e5d61285701a36c3e7f5d9f37b875a8d93e
Instruction Fuzzy Hash: B7A1F9B1900604ABC735DF68D881AEBB3F8EF49314F00C61DF68EC7645DB75A9858BA1

Function 00406F70 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 125stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406F91
lstrcpyA.KERNEL32(00000000,HKCU\), ref: 00406FFE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000400), ref: 00407017
_wcsnicmp.MSVCRT ref: 00407061

Strings

%S%s%s, xrefs: 00407077, 00407097
brk, xrefs: 0040707C, 0040709C
HKCU\, xrefs: 00406FF5
rreg, xrefs: 004070AB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00407026, 0040704A, 0040705B
HKLM\, xrefs: 00406FDE
%s.%s%s, xrefs: 004070B0

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ByteCharMultiWide_wcsnicmplstrcpymemset
String ID: %S%s%s$%s.%s%s$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
API String ID: 2911520168-3007424447
Opcode ID: 24fe703b4de6350d17fbfb4750cd8bb4c3951149c9ffddb89d5d1c17b520efb2
Instruction ID: 52cdffd3aed9817ff0f5470690bd97fa8b38541f7e8b3e480f67bf3efe9e444e
Opcode Fuzzy Hash: 24fe703b4de6350d17fbfb4750cd8bb4c3951149c9ffddb89d5d1c17b520efb2
Instruction Fuzzy Hash: D241A5B1B54218BBDB10CF95DC42FEF77ACAB58714F10412BFA04F2281E678A9508769

Function 00366F70 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 125stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00366F91
lstrcpyA.KERNEL32(00000000,HKCU\), ref: 00366FFE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000400), ref: 00367017
_wcsnicmp.MSVCRT ref: 00367061

Strings

%S%s%s, xrefs: 00367077, 00367097
HKLM\, xrefs: 00366FDE
HKCU\, xrefs: 00366FF5
%s.%s%s, xrefs: 003670B0
rreg, xrefs: 003670AB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00367026, 0036704A, 0036705B
brk, xrefs: 0036707C, 0036709C

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ByteCharMultiWide_wcsnicmplstrcpymemset
String ID: %S%s%s$%s.%s%s$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
API String ID: 2911520168-3007424447
Opcode ID: 0d45d3b2ba07d0a4a0618b33501e6458a9cbacb258cddf956ad6d2cd269dfc33
Instruction ID: 56029d94d50216742f54f4b340fdfa432c3bc340f62fbbf4362b17196c786093
Opcode Fuzzy Hash: 0d45d3b2ba07d0a4a0618b33501e6458a9cbacb258cddf956ad6d2cd269dfc33
Instruction Fuzzy Hash: 3D41C4B2A50208BBDB22CB94DC42EFE77BCEB59714F048119FA08E7285E674994087B5

Function 0040E880 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84pipestringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E8A0
lstrlenA.KERNEL32(30e44aa1), ref: 0040E8AD
_snprintf.MSVCRT ref: 0040E8D0
CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0040E8FF
ConnectNamedPipe.KERNEL32(00000000,00000000), ref: 0040E913
GetLastError.KERNEL32 ref: 0040E91D
CreateThread.KERNEL32(00000000,00000000,Function_0000D7A0,00000000,00000000,00000000), ref: 0040E941
CloseHandle.KERNEL32(00000000), ref: 0040E94B
CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 0040E96E

Strings

\\.\pipe\%08x_ipc, xrefs: 0040E8BF
30e44aa1, xrefs: 0040E8A8, 0040E8B4

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CreateNamedPipe$CloseConnectErrorHandleLastThread_snprintflstrlenmemset
String ID: 30e44aa1$\\.\pipe\%08x_ipc
API String ID: 4065143564-1096776489
Opcode ID: e693463ca9314ef0d474e7815daa56aeeb6a66ebd1abb46cdd44f1c84a99d209
Instruction ID: 85e23c8102626b95d66f369786d20e7ea1e1dc74d471df5540707f019a3fc3e2
Opcode Fuzzy Hash: e693463ca9314ef0d474e7815daa56aeeb6a66ebd1abb46cdd44f1c84a99d209
Instruction Fuzzy Hash: 172135B1BC03147AF33063658C47FEA7618AB54F10F248676FB04FA0D0DAF4694446AC

Function 00405A20 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 189threadlibraryCOMMON

Download Yara Rule

APIs

LdrEnumerateLoadedModules.NTDLL(00000000,00405040,g\@), ref: 00405B0D
CreateThread.KERNEL32(00000000,00000000,00405070,00000000,00000000,00000000), ref: 00405C03
CloseHandle.KERNEL32(00000000), ref: 00405C0A
CreateThread.KERNEL32(00000000,00000000,004050F0,00000000,00000000,00000000), ref: 00405C3D
CloseHandle.KERNEL32(00000000), ref: 00405C44

Part of subcall function 00403920: RtlAnsiStringToUnicodeString.NTDLL(?,?,00000000), ref: 00403962

Strings

g\@, xrefs: 00405AA7, 00405AB8
ntdll.dll, xrefs: 00405B22, 00405B40
g\@, xrefs: 00405AF4, 00405AFD
NtResumeThread, xrefs: 00405B1D
LdrLoadDll, xrefs: 00405B3B

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CloseCreateHandleStringThread$AnsiEnumerateLoadedModulesUnicode
String ID: LdrLoadDll$NtResumeThread$g\@$g\@$ntdll.dll
API String ID: 1691487058-1858031983
Opcode ID: 15177fe99cea3c95e7436bba47e17e1593aa2991ecdead64e05b4e770913e227
Instruction ID: d2a4e14280715d1041b6f2962eb7ad267d111edd4e47b72a6ec2395f63253a1b
Opcode Fuzzy Hash: 15177fe99cea3c95e7436bba47e17e1593aa2991ecdead64e05b4e770913e227
Instruction Fuzzy Hash: A1619DB5740B02ABDB24DF69CC81F6B73A4EB44704F14453AE941AB7D1D678F9018E98

Function 00407100 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 102stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407121
lstrcpyW.KERNEL32(?,HKCU\), ref: 00407172
_wcsnicmp.MSVCRT ref: 004071A8

Strings

brk, xrefs: 004071C6, 004071E9
%s.%S%S, xrefs: 00407200
rreg, xrefs: 004071FB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040717F, 00407197, 004071A2
%S%S%S, xrefs: 004071C1, 004071E4
HKCU\, xrefs: 00407166
HKLM\, xrefs: 0040714C

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: _wcsnicmplstrcpymemset
String ID: %S%S%S$%s.%S%S$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
API String ID: 1531173107-4065158899
Opcode ID: 15fef406b5b0ac02f8dd93d8979f457128f2eb8a91285582a43150cae03d9c6d
Instruction ID: 0d62909f67cd26c4267f5d97f7bb411455192b825f2191604f2d867da3f0bcac
Opcode Fuzzy Hash: 15fef406b5b0ac02f8dd93d8979f457128f2eb8a91285582a43150cae03d9c6d
Instruction Fuzzy Hash: D5310B71E853147AD710DF849C46FEB336CDF98745F10416BFD04B2282E578B99086AE

Function 00367100 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 102stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00367121
lstrcpyW.KERNEL32(?,HKCU\), ref: 00367172
_wcsnicmp.MSVCRT ref: 003671A8

Strings

HKCU\, xrefs: 00367166
%S%S%S, xrefs: 003671C1, 003671E4
rreg, xrefs: 003671FB
%s.%S%S, xrefs: 00367200
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0036717F, 00367197, 003671A2
HKLM\, xrefs: 0036714C
brk, xrefs: 003671C6, 003671E9

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: _wcsnicmplstrcpymemset
String ID: %S%S%S$%s.%S%S$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
API String ID: 1531173107-4065158899
Opcode ID: e3e7edb0a543890e5ba46add6a6594e831ef531ac7ee9f9ae8093df41f508619
Instruction ID: e92308c8f6088221fd27f308028b5a557b0fb31541fa595c3dbeb87617dc812f
Opcode Fuzzy Hash: e3e7edb0a543890e5ba46add6a6594e831ef531ac7ee9f9ae8093df41f508619
Instruction Fuzzy Hash: 72312477A50218BADB22DE48DC86EFB33ACEB58714F008505FD08A2246E6B4AD5087F5

Function 00406940 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 72stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004019F0: wcsrchr.MSVCRT ref: 004019F9

Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747

strstr.MSVCRT ref: 004069A8
lstrcmpA.KERNEL32(00416D88,0044AC50,?,?,?,?,?,?), ref: 004069BE
SetFileAttributesA.KERNEL32(00416E90,00000080,?,?,?,?,?,?), ref: 004069D2
DeleteFileA.KERNEL32(00416E90,?,?,?,?,?,?), ref: 004069DD
MoveFileExA.KERNEL32 ref: 004069EC

Part of subcall function 0040A310: memset.MSVCRT ref: 0040A335
Part of subcall function 0040A310: memset.MSVCRT ref: 0040A34F
Part of subcall function 0040A310: memset.MSVCRT ref: 0040A369
Part of subcall function 0040A310: _vsnprintf.MSVCRT ref: 0040A382
Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A39A
Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB,%s.%s,blk,?,?,000001FE,00410A8E), ref: 0040A3AD
Part of subcall function 0040A310: _snprintf.MSVCRT ref: 0040A3CC
Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,004074EB), ref: 0040A3DB
Part of subcall function 0040A310: sprintf.MSVCRT ref: 0040A3EC
Part of subcall function 0040A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A3FB
Part of subcall function 0040A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0040A404
Part of subcall function 0040A310: EnterCriticalSection.KERNEL32(0044AC34,?,?,00000000), ref: 0040A436
Part of subcall function 0040A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0040A452
Part of subcall function 0040A310: LeaveCriticalSection.KERNEL32(0044AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A464

Strings

%s.Blocked "%S" from creating "%S", xrefs: 00406A24
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!, xrefs: 00406A06
autorun.inf, xrefs: 00406970
pdef, xrefs: 00406986
.exe, xrefs: 0040699C

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$Filememset$CriticalSection_snprintfsprintf$AttributesCreateDeleteEnterLeaveMove_vsnprintflstrcmpstrstrwcsrchr
String ID: %s.Blocked "%S" from creating "%S"$%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!$.exe$autorun.inf$pdef
API String ID: 2285763329-814828592
Opcode ID: 205a7d89b2524849cebba101b25715d3832c541841bc0d4d6ca336ccb213c6d9
Instruction ID: 767322c83212b5698aabde80e4d44f6b16f99ddbb09b22e2f03322de5ae40dfa
Opcode Fuzzy Hash: 205a7d89b2524849cebba101b25715d3832c541841bc0d4d6ca336ccb213c6d9
Instruction Fuzzy Hash: 19118979BC031033DA1037597C47FCB36494B51B56F164037FA15F12D2D9ADD8A085AE

Function 00366940 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 72stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003619F0: wcsrchr.MSVCRT ref: 003619F9

Part of subcall function 00367700: memset.MSVCRT ref: 0036771E
Part of subcall function 00367700: _snprintf.MSVCRT ref: 00367738
Part of subcall function 00367700: lstrlenA.KERNEL32(00000000), ref: 00367747

strstr.MSVCRT ref: 003669A8
lstrcmpA.KERNEL32(00376D88,003AAC50,?,?,?,?,?,?), ref: 003669BE
SetFileAttributesA.KERNEL32(00376E90,00000080,?,?,?,?,?,?), ref: 003669D2
DeleteFileA.KERNEL32(00376E90,?,?,?,?,?,?), ref: 003669DD
MoveFileExA.KERNEL32 ref: 003669EC

Part of subcall function 0036A310: memset.MSVCRT ref: 0036A335
Part of subcall function 0036A310: memset.MSVCRT ref: 0036A34F
Part of subcall function 0036A310: memset.MSVCRT ref: 0036A369
Part of subcall function 0036A310: _vsnprintf.MSVCRT ref: 0036A382
Part of subcall function 0036A310: sprintf.MSVCRT ref: 0036A39A
Part of subcall function 0036A310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB,%s.%s,blk,?,?,000001FE,00370A8E), ref: 0036A3AD
Part of subcall function 0036A310: _snprintf.MSVCRT ref: 0036A3CC
Part of subcall function 0036A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003674EB), ref: 0036A3DB
Part of subcall function 0036A310: sprintf.MSVCRT ref: 0036A3EC
Part of subcall function 0036A310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A3FB
Part of subcall function 0036A310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 0036A404
Part of subcall function 0036A310: EnterCriticalSection.KERNEL32(003AAC34,?,?,00000000), ref: 0036A436
Part of subcall function 0036A310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 0036A452
Part of subcall function 0036A310: LeaveCriticalSection.KERNEL32(003AAC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036A464

Strings

%s.Blocked "%S" from creating "%S", xrefs: 00366A24
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!, xrefs: 00366A06
autorun.inf, xrefs: 00366970
pdef, xrefs: 00366986
.exe, xrefs: 0036699C

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$Filememset$CriticalSection_snprintfsprintf$AttributesCreateDeleteEnterLeaveMove_vsnprintflstrcmpstrstrwcsrchr
String ID: %s.Blocked "%S" from creating "%S"$%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!$.exe$autorun.inf$pdef
API String ID: 2285763329-814828592
Opcode ID: aa8d3641da415f0101304a2d31fc716aea53b89728405501a1d19bc39424ca93
Instruction ID: da8857a622cbcf7fee80e27095a0a43edca682f8b72e98adcbbd609f166c71e1
Opcode Fuzzy Hash: aa8d3641da415f0101304a2d31fc716aea53b89728405501a1d19bc39424ca93
Instruction Fuzzy Hash: 161194BB7C070032DA3326D9AC47FEF36494B91B96F09C024FD0CF519ADA95981085B2

Function 00403C90 Relevance: 16.7, APIs: 11, Instructions: 227filepipeCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32 ref: 00403DA4
ReadFile.KERNEL32(?,-00417960,00000800,00000000), ref: 00403DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403E3E
ReadFile.KERNEL32(?,00417960,00000800,00000000,?), ref: 00403ED7
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EE3
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EEA
GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403EF3
DisconnectNamedPipe.KERNEL32(?,?,?,00000000,000000FF,?,?), ref: 00403F68
ConnectNamedPipe.KERNEL32(?,?,?,?,00000000,000000FF,?,?), ref: 00403F7E

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLast$FileNamedPipeRead$ConnectDisconnectMultipleObjectsOverlappedResultWait
String ID:
API String ID: 4113577031-0
Opcode ID: 2dd0d3f7e6905856f8620d5e3fef185a33115fdb9533bf0cb694795480849065
Instruction ID: ac3e6ea8bc8c8074bcac9458f0b4c946774cbfc70c0eded63f488d96161438d0
Opcode Fuzzy Hash: 2dd0d3f7e6905856f8620d5e3fef185a33115fdb9533bf0cb694795480849065
Instruction Fuzzy Hash: D691C3B5604219AFE714CF28D8C4FAA7BB8FF49305F004279E94597390C775EA51CBA4

Function 00363C90 Relevance: 16.7, APIs: 11, Instructions: 227filepipeCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32 ref: 00363DA4
ReadFile.KERNEL32(?,-00377960,00000800,00000000), ref: 00363DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00363E3E
ReadFile.KERNEL32(?,00377960,00000800,00000000,?), ref: 00363ED7
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363EE3
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363EEA
GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00363EF3
DisconnectNamedPipe.KERNEL32(?,?,?,00000000,000000FF,?,?), ref: 00363F68
ConnectNamedPipe.KERNEL32(?,?,?,?,00000000,000000FF,?,?), ref: 00363F7E

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ErrorLast$FileNamedPipeRead$ConnectDisconnectMultipleObjectsOverlappedResultWait
String ID:
API String ID: 4113577031-0
Opcode ID: 13729cccae5160afc9bfa834f0673ea7e26067e33fb3ddb35eaef54f0c8a3106
Instruction ID: b35d7ad920049315a3256b279f868ab1d83dc53264884056662cd4de0844e855
Opcode Fuzzy Hash: 13729cccae5160afc9bfa834f0673ea7e26067e33fb3ddb35eaef54f0c8a3106
Instruction Fuzzy Hash: BB91D4B5604215AFC726DF5CDCC4FAA77A8FB49304F408259E909CB388D772EA41CBA0

Function 00409080 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004090A0

Part of subcall function 0040A0F0: wcsrchr.MSVCRT ref: 0040A0FA

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00409101

Strings

%s.Blocked possible browser exploit pack call on URL '%s', xrefs: 00409192
com, xrefs: 0040912D
iexplore.exe, xrefs: 004090BE
pdef, xrefs: 004090D8
firefox.exe, xrefs: 004090A5
exe, xrefs: 00409115
scr, xrefs: 0040915D
pif, xrefs: 00409145
http, xrefs: 00409172

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ByteCharMultiWidememsetwcsrchr
String ID: %s.Blocked possible browser exploit pack call on URL '%s'$com$exe$firefox.exe$http$iexplore.exe$pdef$pif$scr
API String ID: 519477765-3787805686
Opcode ID: d63373c43e93acd40a58360cc368328db4f21044a5a5c392e3fcfcbe6f0d8047
Instruction ID: efd4538f4b4db184858f8da92d63e99c1f835ee883837e794a8278ba3a2532b2
Opcode Fuzzy Hash: d63373c43e93acd40a58360cc368328db4f21044a5a5c392e3fcfcbe6f0d8047
Instruction Fuzzy Hash: 3C31E6B5A443056AEB20DB519C0AFE7376C9B10345F00426AFD14A62D3E679ED50C6AA

Function 00369080 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003690A0

Part of subcall function 0036A0F0: wcsrchr.MSVCRT ref: 0036A0FA

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00369101

Strings

%s.Blocked possible browser exploit pack call on URL '%s', xrefs: 00369192
com, xrefs: 0036912D
iexplore.exe, xrefs: 003690BE
pif, xrefs: 00369145
http, xrefs: 00369172
exe, xrefs: 00369115
pdef, xrefs: 003690D8
scr, xrefs: 0036915D
firefox.exe, xrefs: 003690A5

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ByteCharMultiWidememsetwcsrchr
String ID: %s.Blocked possible browser exploit pack call on URL '%s'$com$exe$firefox.exe$http$iexplore.exe$pdef$pif$scr
API String ID: 519477765-3787805686
Opcode ID: cce7681bd09bf4d39f9e32cc1242c6fdb04cc5b25c684b1f881c2523c8118ed8
Instruction ID: b5c5d657899c89f0d11024c0f10c7e29f259c4a6a105360d39edfa05535f98b5
Opcode Fuzzy Hash: cce7681bd09bf4d39f9e32cc1242c6fdb04cc5b25c684b1f881c2523c8118ed8
Instruction Fuzzy Hash: BB31F4B6A403096BEF22DF549C0AFE7376C9B16340F05C155FC18AA256EB71DD50CBA2

Function 0040B160 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 69stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00406E9C,00000000,00000000,00000000,?,?,00406E9C), ref: 0040B178
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,00406E9C), ref: 0040B186
lstrlenA.KERNEL32(00406E9C,?,?,00406E9C), ref: 0040B18F
strstr.MSVCRT ref: 0040B19F
strstr.MSVCRT ref: 0040B1B6
lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1C3
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,00406E9C), ref: 0040B1D2
lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1DC
lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00406E9C), ref: 0040B1E5
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040B1F8

Strings

, xrefs: 0040B199

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$Heap$Allocstrstr$Freelstrcpyn
String ID:
API String ID: 1314289781-2344752452
Opcode ID: 671df700651087db9f68e88acf1a80bfe8468f7de7138985c6537d20367a1117
Instruction ID: 0c7384581528d42b7d5f36e6acbd12e0b896a5cfd03da8e96f22c4e7025091be
Opcode Fuzzy Hash: 671df700651087db9f68e88acf1a80bfe8468f7de7138985c6537d20367a1117
Instruction Fuzzy Hash: 4C1177769413147BD710ABA59C45FDB7BACDF49751F004426FB04E3251DAB8ED0087E8

Function 0036B160 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 69stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00366E9C,00000000,00000000,00000000,?,?,00366E9C), ref: 0036B178
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,00366E9C), ref: 0036B186
lstrlenA.KERNEL32(00366E9C,?,?,00366E9C), ref: 0036B18F
strstr.MSVCRT ref: 0036B19F
strstr.MSVCRT ref: 0036B1B6
lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00366E9C), ref: 0036B1C3
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,00366E9C), ref: 0036B1D2
lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00366E9C), ref: 0036B1DC
lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00366E9C), ref: 0036B1E5
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036B1F8

Strings

, xrefs: 0036B199

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$Heap$Allocstrstr$Freelstrcpyn
String ID:
API String ID: 1314289781-2344752452
Opcode ID: 4191f2ac0b2166b31aae8b3b3a7fd20e71b068e549d1eed2e517c8497cc940b4
Instruction ID: 704c44042745152df8a9624c20fa53f0e221637ffef6c49c89795392149b719b
Opcode Fuzzy Hash: 4191f2ac0b2166b31aae8b3b3a7fd20e71b068e549d1eed2e517c8497cc940b4
Instruction Fuzzy Hash: E8118673A01714BBD722ABA99C46F9B77ACEF45711F418015FA08E7211DAB5ED408BF0

Function 0040AC00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82memorynetworkstringCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 0040AC1A
HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0040AC3E
GetLastError.KERNEL32 ref: 0040AC44
HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 0040AC5E
HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0040AC79
lstrcmpW.KERNEL32(POST,00000000), ref: 0040AC85
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040AC99
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040ACB2

Strings

POST, xrefs: 0040AC80

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$AllocFreeHttpInfoQuery$ErrorLastlstrcmp
String ID: POST
API String ID: 770645459-1814004025
Opcode ID: fdf47e3c856405845c85ea16ba9a9e54b5ee40ff6769a125eeb271a545ff0a5a
Instruction ID: 0fbffbe8e505b5e8b43b1d96c34f4003dc7e44b5e0767985707ba2deb4e71632
Opcode Fuzzy Hash: fdf47e3c856405845c85ea16ba9a9e54b5ee40ff6769a125eeb271a545ff0a5a
Instruction Fuzzy Hash: AF218135645214BBE7209BA5AC88EEBBB7CEB89750F10816AFA04E2250D6349D10C7A9

Function 0036AC00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82memorynetworkstringCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 0036AC1A
HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0036AC3E
GetLastError.KERNEL32 ref: 0036AC44
HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 0036AC5E
HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 0036AC79
lstrcmpW.KERNEL32(POST,00000000), ref: 0036AC85
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036AC99
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036ACB2

Strings

POST, xrefs: 0036AC80

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$AllocFreeHttpInfoQuery$ErrorLastlstrcmp
String ID: POST
API String ID: 770645459-1814004025
Opcode ID: 42719650952d1c5b3ec1b9b75da3c7ed4793b915d4511d705e135b089cc0a38d
Instruction ID: d74b75702e63f394400908105716eb3b04e64d29b4a4c9766a2848d998bcd1ca
Opcode Fuzzy Hash: 42719650952d1c5b3ec1b9b75da3c7ed4793b915d4511d705e135b089cc0a38d
Instruction Fuzzy Hash: 87219037600614BBD7329BA9AC88FAB7B7CEB85760F508159FA08E6144E7319D40DBA1

Function 0040A690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A6AF
memset.MSVCRT ref: 0040A6CA
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000000), ref: 0040A6DF
PathAppendW.SHLWAPI(?,Internet Explorer\iexplore.exe), ref: 0040A6F9
_snwprintf.MSVCRT ref: 0040A71B
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 0040A77F

Strings

Internet Explorer\iexplore.exe, xrefs: 0040A6ED
D, xrefs: 0040A741
"%s" %S, xrefs: 0040A70A

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Pathmemset$AppendCreateFolderProcessSpecial_snwprintf
String ID: "%s" %S$D$Internet Explorer\iexplore.exe
API String ID: 1165436438-694066683
Opcode ID: 7c311cd766287787cc353367e30ac3adf64e14ce37b34e93587ffb04f9e33c4c
Instruction ID: 04848a9af665ce3946de5b24cb2a47d1feeda1f9a2b65442b6e860eb45006ae4
Opcode Fuzzy Hash: 7c311cd766287787cc353367e30ac3adf64e14ce37b34e93587ffb04f9e33c4c
Instruction Fuzzy Hash: 4421A971940308BAEB10DBA0CC46FEA7378AF44B01F148599B7097A1C1EBF59A448B9D

Function 0036A690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036A6AF
memset.MSVCRT ref: 0036A6CA
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000000), ref: 0036A6DF
PathAppendW.SHLWAPI(?,Internet Explorer\iexplore.exe), ref: 0036A6F9
_snwprintf.MSVCRT ref: 0036A71B
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 0036A77F

Strings

"%s" %S, xrefs: 0036A70A
D, xrefs: 0036A741
Internet Explorer\iexplore.exe, xrefs: 0036A6ED

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Pathmemset$AppendCreateFolderProcessSpecial_snwprintf
String ID: "%s" %S$D$Internet Explorer\iexplore.exe
API String ID: 1165436438-694066683
Opcode ID: c98ce7dea8699a97b506d06e443fbdddb459a3ea34e0a62f6c12a9503064a603
Instruction ID: 3f893e18f3ac200f27952f9a7e7c50f42e1c815cf087f430c93f1d89192318cb
Opcode Fuzzy Hash: c98ce7dea8699a97b506d06e443fbdddb459a3ea34e0a62f6c12a9503064a603
Instruction Fuzzy Hash: AE218B71944308BAEB25DBE0CC46FEA7378AF44B01F148588F60D7A1C5EBB59A448B99

Function 00409430 Relevance: 15.1, APIs: 10, Instructions: 109networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313

GetTickCount.KERNEL32 ref: 00409467
htons.WS2_32(?), ref: 00409490
GetTickCount.KERNEL32(?), ref: 004094BD
GetTickCount.KERNEL32 ref: 004094C1
socket.WS2_32(00000002,00000002,00000011), ref: 004094F6
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00409511
sendto.WS2_32(?,?,00001964,00000000,00000002,00000010), ref: 0040953C
Sleep.KERNEL32(00000064,00000002,00000002,00000011), ref: 00409549
closesocket.WS2_32(?), ref: 00409559
GetTickCount.KERNEL32(?), ref: 00409564

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CountTick$Sleepclosesocketgethostbynamehtonsinet_addrioctlsocketsendtosocket
String ID:
API String ID: 2400900511-0
Opcode ID: 08cdf173da6e0b52d7b4d90e9b8344553a2d1643b6037e8e8fd29483bb7c0b4b
Instruction ID: a87c336d0ea31640531df1928f9ed9f7433797ef1bdd0e7b1cbf387240af0400
Opcode Fuzzy Hash: 08cdf173da6e0b52d7b4d90e9b8344553a2d1643b6037e8e8fd29483bb7c0b4b
Instruction Fuzzy Hash: B93130729002246BD710BBFB8D46BEEB2999F88308F11453BF905F71D2D5B89D41C7AA

Function 00369430 Relevance: 15.1, APIs: 10, Instructions: 109networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00369300: inet_addr.WS2_32(n"6), ref: 00369308
Part of subcall function 00369300: gethostbyname.WS2_32(n"6), ref: 00369313

GetTickCount.KERNEL32 ref: 00369467
htons.WS2_32(?), ref: 00369490
GetTickCount.KERNEL32(?), ref: 003694BD
GetTickCount.KERNEL32 ref: 003694C1
socket.WS2_32(00000002,00000002,00000011), ref: 003694F6
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00369511
sendto.WS2_32(?,?,00001964,00000000,00000002,00000010), ref: 0036953C
Sleep.KERNEL32(00000064,00000002,00000002,00000011), ref: 00369549
closesocket.WS2_32(?), ref: 00369559
GetTickCount.KERNEL32(?), ref: 00369564

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CountTick$Sleepclosesocketgethostbynamehtonsinet_addrioctlsocketsendtosocket
String ID:
API String ID: 2400900511-0
Opcode ID: 2d0bb29160b7f58d1b29a98609f763881beb4d39e599d32d7956cc4d729ee439
Instruction ID: 60da4290a813544fe6969eecd173f6694a608e44394a2b10f08b58f30aae1963
Opcode Fuzzy Hash: 2d0bb29160b7f58d1b29a98609f763881beb4d39e599d32d7956cc4d729ee439
Instruction Fuzzy Hash: 8B313D729001249BD722EBF98C46BBEB39D9F88304F528536FA49EB185D9B48D01C7A1

Function 0040ACD0 Relevance: 15.1, APIs: 10, Instructions: 107memorynetworkstringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040ACF5
HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 0040AD0A
InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0040AD2B
GetLastError.KERNEL32 ref: 0040AD31
HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 0040AD4F
InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0040AD63
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 0040AD80
??2@YAPAXI@Z.MSVCRT ref: 0040AD93
lstrcpyA.KERNEL32(?,00000000), ref: 0040ADB3
HeapFree.KERNEL32(?,00000000,00000000), ref: 0040ADE6

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$AllocInternetOptionQuery$??2@ByteCharErrorFreeLastMultiWidelstrcpymemset
String ID:
API String ID: 3155763378-0
Opcode ID: f8d406ff39b3867032f2cbca4d285a4a1005a8dcd899ed6f5777e548e8282404
Instruction ID: 00504cc4e49c33e4c2d117f02b4e2dde52e53599f86eef1a5ae60fdc04d2353b
Opcode Fuzzy Hash: f8d406ff39b3867032f2cbca4d285a4a1005a8dcd899ed6f5777e548e8282404
Instruction Fuzzy Hash: 42317C74500305BBD7209B95CC85FEBBBB9EF8A711F108165FA04AB2D0D7B49D40CBA9

Function 0036ACD0 Relevance: 15.1, APIs: 10, Instructions: 107memorynetworkstringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036ACF5
HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 0036AD0A
InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0036AD2B
GetLastError.KERNEL32 ref: 0036AD31
HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 0036AD4F
InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 0036AD63
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 0036AD80
??2@YAPAXI@Z.MSVCRT ref: 0036AD93
lstrcpyA.KERNEL32(?,00000000), ref: 0036ADB3
HeapFree.KERNEL32(?,00000000,00000000), ref: 0036ADE6

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$AllocInternetOptionQuery$??2@ByteCharErrorFreeLastMultiWidelstrcpymemset
String ID:
API String ID: 3155763378-0
Opcode ID: 74af3b2a445bc6e2730f105fdb887c05632e6bd98fc9b47930d7131c237281e2
Instruction ID: 88d9285c98d00897fb8f9878a1599598a7f0b58bc134a515192ad101ac2e1d6a
Opcode Fuzzy Hash: 74af3b2a445bc6e2730f105fdb887c05632e6bd98fc9b47930d7131c237281e2
Instruction Fuzzy Hash: 8E318075500614BBD722DB99CC85FABBBBCEF86711F508144FA09AB284D7B0AD40CFA1

Function 00409330 Relevance: 15.1, APIs: 10, Instructions: 81networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00409300: inet_addr.WS2_32(n"@), ref: 00409308
Part of subcall function 00409300: gethostbyname.WS2_32(n"@), ref: 00409313

htons.WS2_32(?), ref: 0040935D
GetTickCount.KERNEL32(?), ref: 0040936F
GetTickCount.KERNEL32 ref: 00409373
socket.WS2_32(00000002,00000001,00000000), ref: 004093A6
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004093C1
connect.WS2_32(?,?,00000010), ref: 004093DE
Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 004093EB
closesocket.WS2_32(?), ref: 004093F8
Sleep.KERNEL32(0000004B,?), ref: 00409405
GetTickCount.KERNEL32 ref: 00409407

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CountTick$Sleep$closesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
String ID:
API String ID: 1090714710-0
Opcode ID: de3095b561cd0ee4a074b4b2388ced171c2f3cf8f2c1d860a68ce1fb6dd27ffa
Instruction ID: d2cec284f92f2c482fe6d1749ee7125162ceb74f25a5afa3c33734025d3d2087
Opcode Fuzzy Hash: de3095b561cd0ee4a074b4b2388ced171c2f3cf8f2c1d860a68ce1fb6dd27ffa
Instruction Fuzzy Hash: 90210872800224ABC720FBB9DD45BCEF769DB88304F01462AF908F72D1D6B49D81CB99

Function 00369330 Relevance: 15.1, APIs: 10, Instructions: 81networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00369300: inet_addr.WS2_32(n"6), ref: 00369308
Part of subcall function 00369300: gethostbyname.WS2_32(n"6), ref: 00369313

htons.WS2_32(?), ref: 0036935D
GetTickCount.KERNEL32(?), ref: 0036936F
GetTickCount.KERNEL32 ref: 00369373
socket.WS2_32(00000002,00000001,00000000), ref: 003693A6
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 003693C1
connect.WS2_32(?,?,00000010), ref: 003693DE
Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 003693EB
closesocket.WS2_32(?), ref: 003693F8
Sleep.KERNEL32(0000004B,?), ref: 00369405
GetTickCount.KERNEL32 ref: 00369407

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CountTick$Sleep$closesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
String ID:
API String ID: 1090714710-0
Opcode ID: 28009f9c97aba0445a8354ef7f30ad8305f256150ea8f071ea275ea418510cfe
Instruction ID: a6f5bb31eab11e8b71ba245a515787df8581fc6b62c7c976c5847162294eb4f6
Opcode Fuzzy Hash: 28009f9c97aba0445a8354ef7f30ad8305f256150ea8f071ea275ea418510cfe
Instruction Fuzzy Hash: 4B210872900224ABC722FBB89D45B9EB76D9B84310F128616F90CEB284D6B49D41CBD1

Function 0040FC90 Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 57stringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040FCB0
lstrlenA.KERNEL32(30e44aa1), ref: 0040FCBD
_snprintf.MSVCRT ref: 0040FCE0
lstrcpyW.KERNEL32(0044B9A0,0044ADA0), ref: 0040FCF2
lstrcpyA.KERNEL32(0044BDB0,RECYCLED), ref: 0040FD08
lstrcpyA.KERNEL32(0044BEB4,?), ref: 0040FD16

Part of subcall function 0040F9E0: memset.MSVCRT ref: 0040F9FF
Part of subcall function 0040F9E0: GetLogicalDriveStringsA.KERNEL32 ref: 0040FA22
Part of subcall function 0040F9E0: lstrcatA.KERNEL32(00000000,00413040), ref: 0040FA5C

Sleep.KERNEL32(00003A98), ref: 0040FD61

Strings

%0x.exe, xrefs: 0040FCCF
30e44aa1, xrefs: 0040FCB8, 0040FCC4
RECYCLED, xrefs: 0040FCFE

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrcpy$memset$DriveLogicalSleepStrings_snprintflstrcatlstrlen
String ID: %0x.exe$30e44aa1$RECYCLED
API String ID: 530497602-684435549
Opcode ID: 0cfa70081205f2bb7b5b1627183ae57c4ab90c2d5b469cd82343f9c2e12f9893
Instruction ID: dc7a5fa392d0d149d72329117f2babda223c444661474c01379b6b2072300756
Opcode Fuzzy Hash: 0cfa70081205f2bb7b5b1627183ae57c4ab90c2d5b469cd82343f9c2e12f9893
Instruction Fuzzy Hash: D611C8B9940318BBD310AF65AC82BD5B678EB49704F50407BF604A21D1D7F859C48F9D

Function 0036FC90 Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 57stringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036FCB0
lstrlenA.KERNEL32(30e44aa1), ref: 0036FCBD
_snprintf.MSVCRT ref: 0036FCE0
lstrcpyW.KERNEL32(003AB9A0,003AADA0), ref: 0036FCF2
lstrcpyA.KERNEL32(003ABDB0,RECYCLED), ref: 0036FD08
lstrcpyA.KERNEL32(003ABEB4,?), ref: 0036FD16

Part of subcall function 0036F9E0: memset.MSVCRT ref: 0036F9FF
Part of subcall function 0036F9E0: GetLogicalDriveStringsA.KERNEL32 ref: 0036FA22
Part of subcall function 0036F9E0: lstrcatA.KERNEL32(00000000,00373040), ref: 0036FA5C

Sleep.KERNEL32(00003A98), ref: 0036FD61

Strings

30e44aa1, xrefs: 0036FCB8, 0036FCC4
RECYCLED, xrefs: 0036FCFE
%0x.exe, xrefs: 0036FCCF

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrcpy$memset$DriveLogicalSleepStrings_snprintflstrcatlstrlen
String ID: %0x.exe$30e44aa1$RECYCLED
API String ID: 530497602-684435549
Opcode ID: 038bc5167953571c183dcd695717a34b9ccc95d2b8bf01a1a522f80f16c3dc47
Instruction ID: 34495751ad4c564055f3154d558ac0157d9077052543804f819e087ad413350a
Opcode Fuzzy Hash: 038bc5167953571c183dcd695717a34b9ccc95d2b8bf01a1a522f80f16c3dc47
Instruction Fuzzy Hash: 4111A7B2940218AFD323AF68AC82AE5B76CEB16700F448069F64856197D7F529C48F51

Function 004089B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004089C5
AcquireCredentialsHandleW.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 00408A32
QueryContextAttributesW.SECUR32(?,00000004,00000001), ref: 00408AC3
InitializeSecurityContextW.SECUR32(?,00000000,?,0008C11C,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00408A79

Part of subcall function 00408760: FreeContextBuffer.SECUR32(?), ref: 00408774

Part of subcall function 00408790: InitializeSecurityContextW.SECUR32(?,?,?,0008C11C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 004088AE

DeleteSecurityContext.SECUR32(?), ref: 00408B17
FreeCredentialsHandle.SECUR32(?), ref: 00408B1E

Strings

Microsoft Unified Security Protocol Provider, xrefs: 004089E0
, xrefs: 00408A14

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Context$Security$CredentialsFreeHandleInitialize$AcquireAttributesBufferDeleteQuerymemset
String ID: $Microsoft Unified Security Protocol Provider
API String ID: 3657786480-3891800672
Opcode ID: af5bcdb1a2eef447009338cc511fe135db259d21b177dfce1ff198aca339893a
Instruction ID: beda717db611c482a8f93d0b8a0973b6a55a9a325cb36f24a7304a88d952abe4
Opcode Fuzzy Hash: af5bcdb1a2eef447009338cc511fe135db259d21b177dfce1ff198aca339893a
Instruction Fuzzy Hash: 605127B1D00208ABDB20DFAADD859EFFBF8FF94704F10452EE505E6251E7B4A6058B64

Function 003689B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003689C5
AcquireCredentialsHandleW.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 00368A32
QueryContextAttributesW.SECUR32(?,00000004,00000001), ref: 00368AC3
InitializeSecurityContextW.SECUR32(?,00000000,?,0008C11C,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00368A79

Part of subcall function 00368760: FreeContextBuffer.SECUR32(?), ref: 00368774

Part of subcall function 00368790: InitializeSecurityContextW.SECUR32(?,?,?,0008C11C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 003688AE

DeleteSecurityContext.SECUR32(?), ref: 00368B17
FreeCredentialsHandle.SECUR32(?), ref: 00368B1E

Strings

, xrefs: 00368A14
Microsoft Unified Security Protocol Provider, xrefs: 003689E0

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Context$Security$CredentialsFreeHandleInitialize$AcquireAttributesBufferDeleteQuerymemset
String ID: $Microsoft Unified Security Protocol Provider
API String ID: 3657786480-3891800672
Opcode ID: 69a5bd4db19f190252c1b7c9026e36aed30769e0d2ebff970da068ee60dff6a9
Instruction ID: 862b6b74ed03e32e2e65e8d4b6987eb21d9028d2a6d32cf160adad4ce33bb399
Opcode Fuzzy Hash: 69a5bd4db19f190252c1b7c9026e36aed30769e0d2ebff970da068ee60dff6a9
Instruction Fuzzy Hash: A55118B1D00208ABDB21DF9ADC859AFFBFCFF98700F10851AE505E7215E7B4A6458B60

Function 00401D10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401D31
memset.MSVCRT ref: 00401D4B
lstrcmpA.KERNEL32(00000000,block), ref: 00401D9B
strstr.MSVCRT ref: 00401DAB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000400), ref: 00401DCA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000200,00000000,00000000), ref: 00401E0C

Strings

block, xrefs: 00401D95
bdns, xrefs: 00401D6E, 00401E29

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ByteCharMultiWidememset$lstrcmpstrstr
String ID: bdns$block
API String ID: 1883446694-4143068083
Opcode ID: 0186ad86ad553c35ed268445183641265aed177f885356a13713a37939fdbb1b
Instruction ID: 02cb723c2acadd3014a6e1aa2f0b914f9df801f99115c0613e607c9dec7c965c
Opcode Fuzzy Hash: 0186ad86ad553c35ed268445183641265aed177f885356a13713a37939fdbb1b
Instruction Fuzzy Hash: 8B313A756403087BEB20DB55EC0AFEB736CDF84710F00416AFE14B62D1EAB4AE50C6A9

Function 00361D10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00361D31
memset.MSVCRT ref: 00361D4B
lstrcmpA.KERNEL32(00000000,block), ref: 00361D9B
strstr.MSVCRT ref: 00361DAB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000400), ref: 00361DCA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000200,00000000,00000000), ref: 00361E0C

Strings

bdns, xrefs: 00361D6E, 00361E29
block, xrefs: 00361D95

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ByteCharMultiWidememset$lstrcmpstrstr
String ID: bdns$block
API String ID: 1883446694-4143068083
Opcode ID: 94ed2e8dee14fc3d89270e3f1cb6dfb9ea20584cbe66336e81584b56e07710b2
Instruction ID: 997e66308cf864de44e392751d0634f1f44a958501c9d28c5c0193a85efd5a6f
Opcode Fuzzy Hash: 94ed2e8dee14fc3d89270e3f1cb6dfb9ea20584cbe66336e81584b56e07710b2
Instruction Fuzzy Hash: FF31E3B6640204BBEB32DA58DC06FFB736C9F84711F048159FE18AA1C5EAB59A10C6A1

Function 00403B90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,00405182,?,?,?,00437AE8), ref: 00403BD8
CreateNamedPipeA.KERNEL32(?,40000001,00000000,000000FF,00010000,00010000,00000000,00000000), ref: 00403C0F
ConnectNamedPipe.KERNEL32(00000000,?,?,?,?,00405182,?,?,?,00437AE8), ref: 00403C25
GetLastError.KERNEL32(?,?,?,00405182,?,?,?,00437AE8), ref: 00403C2F
GetLastError.KERNEL32(?,?,?,00405182,?,?,?,00437AE8), ref: 00403C46
SetEvent.KERNEL32(00000000,?,?,?,00405182,?,?,?,00437AE8), ref: 00403C56

Strings

zC, xrefs: 00403BA0

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CreateErrorEventLastNamedPipe$Connect
String ID: zC
API String ID: 3507186782-3727955402
Opcode ID: 37271feab1efd766603c5ed1eb9c75c67124974bf2be737a9f078a6ab44b23cc
Instruction ID: c73fd8eed312285066e6433c0d2a5033b489b0f8818e27d85342ab9d2f4f481c
Opcode Fuzzy Hash: 37271feab1efd766603c5ed1eb9c75c67124974bf2be737a9f078a6ab44b23cc
Instruction Fuzzy Hash: 5F21D8767442057BE7209F64DCC4BD6BB68EB44751F208536FB0DEA2D0D3B4E9408758

Function 00363B90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,00365182,?,?,?,00397AE8), ref: 00363BD8
CreateNamedPipeA.KERNEL32(?,40000001,00000000,000000FF,00010000,00010000,00000000,00000000), ref: 00363C0F
ConnectNamedPipe.KERNEL32(00000000,?,?,?,?,00365182,?,?,?,00397AE8), ref: 00363C25
GetLastError.KERNEL32(?,?,?,00365182,?,?,?,00397AE8), ref: 00363C2F
GetLastError.KERNEL32(?,?,?,00365182,?,?,?,00397AE8), ref: 00363C46
SetEvent.KERNEL32(00000000,?,?,?,00365182,?,?,?,00397AE8), ref: 00363C56

Strings

z9, xrefs: 00363BA0

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CreateErrorEventLastNamedPipe$Connect
String ID: z9
API String ID: 3507186782-1860472296
Opcode ID: 7a1c556f5c0f55d37dd537138dd2503d13cc638c9040fa02a23836268fb25f84
Instruction ID: 275ee4cfa44da5b8b31d5ec6a355ff446386184ccc2485dd96f7f5baaf69f2f1
Opcode Fuzzy Hash: 7a1c556f5c0f55d37dd537138dd2503d13cc638c9040fa02a23836268fb25f84
Instruction Fuzzy Hash: B621C576750206AFE7228F68DCC8B99BB68EF44761F208525FA1DDB180D7B1E9808B50

Function 00401000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(?,0044AC50), ref: 0040100D
lstrcmpA.KERNEL32(?,0044AA28), ref: 00401054
MoveFileExA.KERNEL32 ref: 00401062
lstrcpyA.KERNEL32(00416D88,?), ref: 0040108B
lstrcpyA.KERNEL32(00416E90,?), ref: 00401093

Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747

Strings

ruskill, xrefs: 0040106D
pdef, xrefs: 00401017
%s.%s, xrefs: 00401072

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrcmplstrcpy$FileMove_snprintflstrlenmemset
String ID: %s.%s$pdef$ruskill
API String ID: 4105673886-2574534833
Opcode ID: c6808c051f051d8e2374252726ea8595a063285eb58d62e8aeaf39ff97766995
Instruction ID: 4fe7375c48cb0ed1c8aec0ef7938256b6d24936e215c646bbef161c2785726af
Opcode Fuzzy Hash: c6808c051f051d8e2374252726ea8595a063285eb58d62e8aeaf39ff97766995
Instruction Fuzzy Hash: 0701F53678021477D3205B69AC49FDBB79CDB58764B140037FB08E26A1D678D880C27E

Function 00361000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(?,003AAC50), ref: 0036100D
lstrcmpA.KERNEL32(?,003AAA28), ref: 00361054
MoveFileExA.KERNEL32 ref: 00361062
lstrcpyA.KERNEL32(00376D88,?), ref: 0036108B
lstrcpyA.KERNEL32(00376E90,?), ref: 00361093

Part of subcall function 00367700: memset.MSVCRT ref: 0036771E
Part of subcall function 00367700: _snprintf.MSVCRT ref: 00367738
Part of subcall function 00367700: lstrlenA.KERNEL32(00000000), ref: 00367747

Strings

%s.%s, xrefs: 00361072
ruskill, xrefs: 0036106D
pdef, xrefs: 00361017

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrcmplstrcpy$FileMove_snprintflstrlenmemset
String ID: %s.%s$pdef$ruskill
API String ID: 4105673886-2574534833
Opcode ID: d5c8281d7d87af580f3dfbc646b4583b555b515a73af2078d66b7b237c6da99b
Instruction ID: 4ee66d274671f531af44d17fda274c931a6bf56f46f29c99618a47ebd3288f5f
Opcode Fuzzy Hash: d5c8281d7d87af580f3dfbc646b4583b555b515a73af2078d66b7b237c6da99b
Instruction Fuzzy Hash: D401247B3406007BEB335B6EAC4AEEBBB8CEF59760F488010F60CD6146D660C880C276

Function 00409C60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 81stringmemoryCOMMON

Download Yara Rule

APIs

strtok.MSVCRT ref: 00409C7C
HeapFree.KERNEL32(?,00000000,?), ref: 00409C9A
lstrcpyA.KERNEL32(0044B648,00411335), ref: 00409CB3
lstrcpynA.KERNEL32(0044B648,00000000,00000200), ref: 00409CC4
strtok.MSVCRT ref: 00409CDB
atoi.MSVCRT(00000000), ref: 00409CE8
HeapFree.KERNEL32(?,00000000,?), ref: 00409D73

Strings

[Slowloris]: Finished flood on "%s", xrefs: 00409D45
[Slowloris]: Starting flood on "%s" for %d minute(s), xrefs: 00409CF9

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: FreeHeapstrtok$atoilstrcpylstrcpyn
String ID: [Slowloris]: Finished flood on "%s"$[Slowloris]: Starting flood on "%s" for %d minute(s)
API String ID: 1726920797-1250431664
Opcode ID: 02698c9e1c9b5a337fd9f870c731ce9dae944a898e9a5d2947721506a0970c02
Instruction ID: 5abb1ecf655548da32f96995d5207bda4e63050bb647f4713687c5726d83be91
Opcode Fuzzy Hash: 02698c9e1c9b5a337fd9f870c731ce9dae944a898e9a5d2947721506a0970c02
Instruction Fuzzy Hash: 6C2198B6780704ABE310ABA5AC47FE7369CE754755F10403AF608A61D1D7BD98408BED

Function 00369C60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 81stringmemoryCOMMON

Download Yara Rule

APIs

strtok.MSVCRT ref: 00369C7C
HeapFree.KERNEL32(?,00000000,?), ref: 00369C9A
lstrcpyA.KERNEL32(003AB648,00371335), ref: 00369CB3
lstrcpynA.KERNEL32(003AB648,00000000,00000200), ref: 00369CC4
strtok.MSVCRT ref: 00369CDB
atoi.MSVCRT(00000000), ref: 00369CE8
HeapFree.KERNEL32(?,00000000,?), ref: 00369D73

Strings

[Slowloris]: Finished flood on "%s", xrefs: 00369D45
[Slowloris]: Starting flood on "%s" for %d minute(s), xrefs: 00369CF9

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: FreeHeapstrtok$atoilstrcpylstrcpyn
String ID: [Slowloris]: Finished flood on "%s"$[Slowloris]: Starting flood on "%s" for %d minute(s)
API String ID: 1726920797-1250431664
Opcode ID: a976d055c2555a0bfb93bda30f5910cfad1bad5bb9e827492efcad102436f466
Instruction ID: 80f12125437a035bbc888a026a5466e34fa7ab8de5038ad23ac400b455c8f862
Opcode Fuzzy Hash: a976d055c2555a0bfb93bda30f5910cfad1bad5bb9e827492efcad102436f466
Instruction Fuzzy Hash: 8321F673640B44ABE333ABA4AC4AFA77B9CE715711F048029F60C9A196C7F94840CBA0

Function 00410BB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMON

Download Yara Rule

APIs

_stricmp.MSVCRT(?,GetAddrInfoW), ref: 00410C14
_stricmp.MSVCRT(?,send), ref: 00410C26

Strings

send, xrefs: 00410C20
GetAddrInfoW, xrefs: 00410C0E
wininet.dll, xrefs: 00410BE7
nspr4.dll, xrefs: 00410BD5
dnsapi.dll, xrefs: 00410BF9

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: _stricmp
String ID: GetAddrInfoW$dnsapi.dll$nspr4.dll$send$wininet.dll
API String ID: 2884411883-3553644081
Opcode ID: 36e3ed33dabe1e89e10d8de8e0c2c552be30b71190476765e5e888efa949d741
Instruction ID: 7dd899092242fc79fd89890ffa549661517dd11cf2dee8623fb0997b335437d9
Opcode Fuzzy Hash: 36e3ed33dabe1e89e10d8de8e0c2c552be30b71190476765e5e888efa949d741
Instruction Fuzzy Hash: C3118633B41130629A2455A6AD01BDBA2485B60767F050237FD09E2381E5DDEAD195EE

Function 00370BB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMON

Download Yara Rule

APIs

_stricmp.MSVCRT(?,GetAddrInfoW), ref: 00370C14
_stricmp.MSVCRT(?,send), ref: 00370C26

Strings

nspr4.dll, xrefs: 00370BD5
send, xrefs: 00370C20
GetAddrInfoW, xrefs: 00370C0E
dnsapi.dll, xrefs: 00370BF9
wininet.dll, xrefs: 00370BE7

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: _stricmp
String ID: GetAddrInfoW$dnsapi.dll$nspr4.dll$send$wininet.dll
API String ID: 2884411883-3553644081
Opcode ID: f5d6fca3a01e2a73fe8874995bea9fd34b5ca5bee109a5c5c673ab68ea69a01b
Instruction ID: e2522f50e66a9bcbc7620da0db2159f771c19ba38962f64297c40d48e9d009a3
Opcode Fuzzy Hash: f5d6fca3a01e2a73fe8874995bea9fd34b5ca5bee109a5c5c673ab68ea69a01b
Instruction Fuzzy Hash: 25119833F41131919A3B55656D02BEBA2884B607B6F06C236FD0DDB241D59DDA50D1E2

Function 0040C8C6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C8DD
lstrlenA.KERNEL32(?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C8E5
lstrcatA.KERNEL32(00000000,00412C78,?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0), ref: 0040C907
lstrcatA.KERNEL32(00000000,?,?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0), ref: 0040C913
lstrcmpA.KERNEL32(00000000,http.int,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C985
atoi.MSVCRT(?,?,?,http.set,?,msn.int,?,004157F4,?,004157F0,?,speed,?,rs0,?,stats), ref: 0040C99C
atoi.MSVCRT(00000000), ref: 0040C9AF

Strings

msg, xrefs: 0040C94A
[HTTP]: Updated HTTP spread message to "%s", xrefs: 0040C972
http, xrefs: 0040C955

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: atoilstrcatlstrlen$lstrcmp
String ID: [HTTP]: Updated HTTP spread message to "%s"$http$msg
API String ID: 3861295430-3390247340
Opcode ID: cd66be1e72c6cf93dfedc839c2d5169449ca9746f87a431d2b3f8e4c18d29906
Instruction ID: 1ab7614cfbc0b4fce2ff95c09ce7119ec81f183615a4560a58167f2487451b67
Opcode Fuzzy Hash: cd66be1e72c6cf93dfedc839c2d5169449ca9746f87a431d2b3f8e4c18d29906
Instruction Fuzzy Hash: 6601657594020CAADB20DF60CC81EDAB378AF44304F2045ABD549A3192DB78FA86CF65

Function 0036C8C6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,http.set,?,msn.int,?,003757F4,?,003757F0,?,speed,?,rs0,?,stats), ref: 0036C8DD
lstrlenA.KERNEL32(?,?,http.set,?,msn.int,?,003757F4,?,003757F0,?,speed,?,rs0,?,stats), ref: 0036C8E5
lstrcatA.KERNEL32(00000000,00372C78,?,?,http.set,?,msn.int,?,003757F4,?,003757F0,?,speed,?,rs0), ref: 0036C907
lstrcatA.KERNEL32(00000000,?,?,?,http.set,?,msn.int,?,003757F4,?,003757F0,?,speed,?,rs0), ref: 0036C913
lstrcmpA.KERNEL32(00000000,http.int,?,http.set,?,msn.int,?,003757F4,?,003757F0,?,speed,?,rs0,?,stats), ref: 0036C985
atoi.MSVCRT(?,?,?,http.set,?,msn.int,?,003757F4,?,003757F0,?,speed,?,rs0,?,stats), ref: 0036C99C
atoi.MSVCRT(00000000), ref: 0036C9AF

Strings

[HTTP]: Updated HTTP spread message to "%s", xrefs: 0036C972
msg, xrefs: 0036C94A
http, xrefs: 0036C955

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: atoilstrcatlstrlen$lstrcmp
String ID: [HTTP]: Updated HTTP spread message to "%s"$http$msg
API String ID: 3861295430-3390247340
Opcode ID: 56f157eac6543f671bacc2f6778bda34c2ca0a1f7b0f656f79cb90cf0ed21ec3
Instruction ID: 36e996ee51aab6251366d927034dab49032befccbff6b351b796ab7ab9ed0a8f
Opcode Fuzzy Hash: 56f157eac6543f671bacc2f6778bda34c2ca0a1f7b0f656f79cb90cf0ed21ec3
Instruction Fuzzy Hash: 78016175A1420C9EDB32DF60CC81EEAB378AF44704F11849AE58DA7046DB74FA86CF61

Function 00403DB8 Relevance: 12.1, APIs: 8, Instructions: 108fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,-00417960,00000800,00000000), ref: 00403DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403E3E
ReadFile.KERNEL32(?,00417960,00000800,00000000,?), ref: 00403ED7
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EE3
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EEA
GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403EF3
WaitForMultipleObjects.KERNEL32 ref: 00403F0D
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403F1D

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
String ID:
API String ID: 146293752-0
Opcode ID: 48b095c9934a17c5a57d935e29c9e11065415f2b5555cb5260d4dacb11bb4326
Instruction ID: 1449663287717f94bd81a238159e52aac75588b2a5b986027c9b27bc7671b927
Opcode Fuzzy Hash: 48b095c9934a17c5a57d935e29c9e11065415f2b5555cb5260d4dacb11bb4326
Instruction Fuzzy Hash: 1541D1B4600219AFE710CF68DCC4FAA7BA8FF49304F408668E64597391C731EA11CBA9

Function 00363DB8 Relevance: 12.1, APIs: 8, Instructions: 108fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,-00377960,00000800,00000000), ref: 00363DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00363E3E
ReadFile.KERNEL32(?,00377960,00000800,00000000,?), ref: 00363ED7
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363EE3
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363EEA
GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00363EF3
WaitForMultipleObjects.KERNEL32 ref: 00363F0D
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363F1D

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
String ID:
API String ID: 146293752-0
Opcode ID: 3d72f10a36dbe2ffc3c1dc1083d318be9273227a9902be53aef54ddb9e19d9e0
Instruction ID: 90382d5a3acc7a767e680776586add6836456af10f9c3875855f56faded9b1a1
Opcode Fuzzy Hash: 3d72f10a36dbe2ffc3c1dc1083d318be9273227a9902be53aef54ddb9e19d9e0
Instruction Fuzzy Hash: 2041A3B5604219AFD722DF68DCC4FAA77A8FF49304F408658E549CB389C731E951CBA1

Function 00403DB6 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,-00417960,00000800,00000000), ref: 00403DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403E3E
ReadFile.KERNEL32(?,00417960,00000800,00000000,?), ref: 00403ED7
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EE3
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403EEA
GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00403EF3
WaitForMultipleObjects.KERNEL32 ref: 00403F0D
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00403F1D

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
String ID:
API String ID: 146293752-0
Opcode ID: a3c2b8a4d836f326ba00dd01a2af7da35a594ae8b6e1fa1924fa689e7bbf5e23
Instruction ID: 28271791b9155c45bfcfa5e5e937157ac637d84904cf2cf721747741308823d4
Opcode Fuzzy Hash: a3c2b8a4d836f326ba00dd01a2af7da35a594ae8b6e1fa1924fa689e7bbf5e23
Instruction Fuzzy Hash: 0341B2B4600219AFE710CF68DCC4FAA7B68FF49304F408669E64597391C735EA51CBA9

Function 00363DB6 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,-00377960,00000800,00000000), ref: 00363DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000,?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00363E3E
ReadFile.KERNEL32(?,00377960,00000800,00000000,?), ref: 00363ED7
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363EE3
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363EEA
GetLastError.KERNEL32(?,?,?,00000000,000000FF,?,?,00000000,000000FF,?,?), ref: 00363EF3
WaitForMultipleObjects.KERNEL32 ref: 00363F0D
GetLastError.KERNEL32(?,?,00000000,000000FF,?,?), ref: 00363F1D

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
String ID:
API String ID: 146293752-0
Opcode ID: 3771f26f6f28754f1388daabc80882db2cfc7086968c2b9b0c2728384dcb30d9
Instruction ID: 772b9185d2f65f8558853ca7f5a35d56840028fbe5ddb06671b38c61b651c115
Opcode Fuzzy Hash: 3771f26f6f28754f1388daabc80882db2cfc7086968c2b9b0c2728384dcb30d9
Instruction Fuzzy Hash: DD4191B5604219AFD722DF68DCC4FAA77A8FF49304F408658E546CB289C731EA41CBA1

Function 00407500 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0040752B
_snprintf.MSVCRT ref: 00407547
_vsnprintf.MSVCRT ref: 00407569
lstrcmpA.KERNEL32(?,bdns), ref: 0040758B
StrStrIA.SHLWAPI(?,00000000), ref: 0040759F
lstrlenA.KERNEL32(?), ref: 004075B9

Strings

%s_, xrefs: 00407536
bdns, xrefs: 00407585

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$_snprintf_vsnprintflstrcmp
String ID: %s_$bdns
API String ID: 3897371274-741241040
Opcode ID: 124a044a6255b2877a249701a6b566efcd5087fe13bd7a91ca914f4277930df7
Instruction ID: 4041c77a8ee822b0534c788c84e6158342a9e1cd2e52badc2954bd78d4f0e51c
Opcode Fuzzy Hash: 124a044a6255b2877a249701a6b566efcd5087fe13bd7a91ca914f4277930df7
Instruction Fuzzy Hash: 5421E672A00219BBDB209F69AC85FEB775CEB44714F04457ABE09E3681E638DD0086E5

Function 00367500 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0036752B
_snprintf.MSVCRT ref: 00367547
_vsnprintf.MSVCRT ref: 00367569
lstrcmpA.KERNEL32(?,bdns), ref: 0036758B
StrStrIA.SHLWAPI(?,00000000), ref: 0036759F
lstrlenA.KERNEL32(?), ref: 003675B9

Strings

bdns, xrefs: 00367585
%s_, xrefs: 00367536

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$_snprintf_vsnprintflstrcmp
String ID: %s_$bdns
API String ID: 3897371274-741241040
Opcode ID: 35e38350e6a3f6d72092d7ccb9d39cefc08ae8d5b92f243fbe546bc5b85e36f3
Instruction ID: e20870fcc4bd81c7dd183361c6b36ba1d5abaaa7e4e7011f6c6d078fd9127a02
Opcode Fuzzy Hash: 35e38350e6a3f6d72092d7ccb9d39cefc08ae8d5b92f243fbe546bc5b85e36f3
Instruction Fuzzy Hash: F3215A73600215ABEB319E68AC84FEB775CEB45714F4481A5FE0DD7105E674CD0087E0

Function 00408670 Relevance: 12.1, APIs: 8, Instructions: 70networkmemorythreadCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000103C), ref: 00408688
htons.WS2_32(?), ref: 004086AE
inet_ntoa.WS2_32(?), ref: 004086F7
htons.WS2_32(?), ref: 00408704
GetTickCount.KERNEL32 ref: 00408713
CreateThread.KERNEL32(00000000,00000000,00408640,00000000,00000000,00000000), ref: 00408734
CloseHandle.KERNEL32(00000000), ref: 0040873B

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: htons$AllocCloseCountCreateHandleLocalThreadTickinet_ntoa
String ID:
API String ID: 30336511-0
Opcode ID: ece531b689def736ad1a046acb75a9b161b153146826fb4c6ab30ca57e0e27f5
Instruction ID: 9e76b70b9e18d90a2322bacb59208b5161888f5b1f8e4907ee1d559a765b4a15
Opcode Fuzzy Hash: ece531b689def736ad1a046acb75a9b161b153146826fb4c6ab30ca57e0e27f5
Instruction Fuzzy Hash: F221087894071096D3205B71ED097D77AA4AF08304F10493EF6ED972D0DBF895808B5D

Function 00368670 Relevance: 12.1, APIs: 8, Instructions: 70networkmemorythreadCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000103C), ref: 00368688
htons.WS2_32(?), ref: 003686AE
inet_ntoa.WS2_32(?), ref: 003686F7
htons.WS2_32(?), ref: 00368704
GetTickCount.KERNEL32 ref: 00368713
CreateThread.KERNEL32(00000000,00000000,00368640,00000000,00000000,00000000), ref: 00368734
CloseHandle.KERNEL32(00000000), ref: 0036873B

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: htons$AllocCloseCountCreateHandleLocalThreadTickinet_ntoa
String ID:
API String ID: 30336511-0
Opcode ID: 1ede74fcd523cbfddc0c0320d50d2a17b330f3dead80590ee1645117eb4340c1
Instruction ID: e0bddbe697a7389a2343103d5f15ce7380794a0e257442921ac703f3976f24cd
Opcode Fuzzy Hash: 1ede74fcd523cbfddc0c0320d50d2a17b330f3dead80590ee1645117eb4340c1
Instruction Fuzzy Hash: 7621E7B6640B009BD3235FB4DD0ABDA77ECAF08740F148A19F69D8B2D4DBB49580CB65

Function 00407790 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004077AE
memset.MSVCRT ref: 004077C8
lstrcpyA.KERNEL32(00000000,off), ref: 004077F0
_snprintf.MSVCRT ref: 0040780D
lstrlenA.KERNEL32(00000000), ref: 00407822
lstrlenA.KERNEL32(00000000), ref: 00407858

Strings

state_%s, xrefs: 004077FC
off, xrefs: 004077E4

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlenmemset$_snprintflstrcpy
String ID: off$state_%s
API String ID: 1009457118-628336787
Opcode ID: 70f7641bb32e469b1083378ef79434b0921ef5b18bc2d0549987eaa8ea56221d
Instruction ID: 92198304c3aebce230d4dd1ef02d57304f56152abc6317e3f91bbe1a6584e8e5
Opcode Fuzzy Hash: 70f7641bb32e469b1083378ef79434b0921ef5b18bc2d0549987eaa8ea56221d
Instruction Fuzzy Hash: 5711E1B598131877D720E755CD46FEA736C9F88704F0041EAF748661C2E6F86BC48AA9

Function 00367790 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003677AE
memset.MSVCRT ref: 003677C8
lstrcpyA.KERNEL32(00000000,off), ref: 003677F0
_snprintf.MSVCRT ref: 0036780D
lstrlenA.KERNEL32(00000000), ref: 00367822
lstrlenA.KERNEL32(00000000), ref: 00367858

Strings

state_%s, xrefs: 003677FC
off, xrefs: 003677E4

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlenmemset$_snprintflstrcpy
String ID: off$state_%s
API String ID: 1009457118-628336787
Opcode ID: 9f23c6bf3cbcc9c4216563c022a6c37466f42bca7d7603f0ded00397dc7a4815
Instruction ID: cc24b581526041f9aeab4a7c98934aa246ed02fcf4e8b704b42be48c6ab50663
Opcode Fuzzy Hash: 9f23c6bf3cbcc9c4216563c022a6c37466f42bca7d7603f0ded00397dc7a4815
Instruction Fuzzy Hash: 1011D6B694121877D732E654CD46FEB736C9B54700F4081D4FB4C6A182E6F45B848BA1

Function 00402A30 Relevance: 10.6, APIs: 7, Instructions: 131networksleepCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 00402A44

Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
Part of subcall function 00402460: HeapAlloc.KERNEL32(?,00000008,004020DE,?,004020DE,?), ref: 0040247E

socket.WS2_32(00000002,00000001,00000006), ref: 00402A8A
WSAGetLastError.WS2_32(00000002,00000001,00000006), ref: 00402A96
GetLastError.KERNEL32(00000002,00000001,00000006), ref: 00402A9B

Part of subcall function 004024A0: GetProcessHeap.KERNEL32(00000000,?,00402131,00000000), ref: 004024B4
Part of subcall function 004024A0: HeapFree.KERNEL32(?,00000000,1!@), ref: 004024C3

inet_ntoa.WS2_32(00000002), ref: 00402AEE
connect.WS2_32(00000000,?,00000010), ref: 00402AFC
Sleep.KERNEL32(000005DC,00000000,?,00000010,00000001,00000006), ref: 00402B0B

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocFreeSleepconnecthtonsinet_ntoasocket
String ID:
API String ID: 268164981-0
Opcode ID: 44dedb86cd978a286b815524257946b4e4894fd2ee4a2f55442f8e7975e1c89b
Instruction ID: ce191278c195bcc5fe46e87e2f95668e3f48f171ff9216de77ec0a31515bc727
Opcode Fuzzy Hash: 44dedb86cd978a286b815524257946b4e4894fd2ee4a2f55442f8e7975e1c89b
Instruction Fuzzy Hash: F4411C71E00204ABCB10EFA9D985AAFB3B5EF44324F10457BE519EB3C0D6B9A941CB85

Function 00407F90 Relevance: 10.6, APIs: 7, Instructions: 131networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000000,?,00000000,?), ref: 00407FD4
send.WS2_32(?,?,?,00000000), ref: 00407FFB
LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,00000000,?), ref: 00408004
select.WS2_32(00000000,00000000,00000000,00000001,?), ref: 0040803D
select.WS2_32(00000000,?,00000000,00000000,?), ref: 00408081
recv.WS2_32(?,?,00001000,00000000), ref: 0040809A

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: select$FreeLocalrecvsend
String ID:
API String ID: 1822081929-0
Opcode ID: 0871b2e34e756f4d0f63523cb201b98f0c40d0ec107a21b26a04a251aac6ff47
Instruction ID: 909fc2e90b0f87b3fef5befaca8da21e2df52dd308851a13e64ceea63d8b760f
Opcode Fuzzy Hash: 0871b2e34e756f4d0f63523cb201b98f0c40d0ec107a21b26a04a251aac6ff47
Instruction Fuzzy Hash: 4A41AC712003049BD730DB69D881BE7B3F8EB88710F004A9FF5899B681E6F5A9C48B94

Function 00362A30 Relevance: 10.6, APIs: 7, Instructions: 131networksleepCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 00362A44

Part of subcall function 00362460: GetProcessHeap.KERNEL32(?,003620DE,?), ref: 0036246C
Part of subcall function 00362460: HeapAlloc.KERNEL32(?,00000008,003620DE,?,003620DE,?), ref: 0036247E

socket.WS2_32(00000002,00000001,00000006), ref: 00362A8A
WSAGetLastError.WS2_32(00000002,00000001,00000006), ref: 00362A96
GetLastError.KERNEL32(00000002,00000001,00000006), ref: 00362A9B

Part of subcall function 003624A0: GetProcessHeap.KERNEL32(00000000,?,00362131,00000000), ref: 003624B4
Part of subcall function 003624A0: HeapFree.KERNEL32(?,00000000,1!6), ref: 003624C3

inet_ntoa.WS2_32(00000002), ref: 00362AEE
connect.WS2_32(00000000,?,00000010), ref: 00362AFC
Sleep.KERNEL32(000005DC,00000000,?,00000010,00000001,00000006), ref: 00362B0B

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocFreeSleepconnecthtonsinet_ntoasocket
String ID:
API String ID: 268164981-0
Opcode ID: bfcadc20b8bb598b7875635dc466f004f7a700535ae043ce950b3ae09be9d551
Instruction ID: bf5937e66d65044f7ff70193dd473e818395472c05b458c832c9ac140d7f1877
Opcode Fuzzy Hash: bfcadc20b8bb598b7875635dc466f004f7a700535ae043ce950b3ae09be9d551
Instruction Fuzzy Hash: F141F371E00A049BCB22EFA8D881AAFB3B9EF44320F12C569F559EF344D6719941CBD1

Function 00367F90 Relevance: 10.6, APIs: 7, Instructions: 131networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000000,?,00000000,?), ref: 00367FD4
send.WS2_32(?,?,?,00000000), ref: 00367FFB
LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,00000000,?), ref: 00368004
select.WS2_32(00000000,00000000,00000000,00000001,?), ref: 0036803D
select.WS2_32(00000000,?,00000000,00000000,?), ref: 00368081
recv.WS2_32(?,?,00001000,00000000), ref: 0036809A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: select$FreeLocalrecvsend
String ID:
API String ID: 1822081929-0
Opcode ID: 9b26299577c8201637e5e906a5b2313375ded33ff1ccd64c5d7e86a4724e60e5
Instruction ID: 708097e4dbf1726e06b8bfb7b2901984775fe1b11cf976bc956b4b9ceb4a0709
Opcode Fuzzy Hash: 9b26299577c8201637e5e906a5b2313375ded33ff1ccd64c5d7e86a4724e60e5
Instruction Fuzzy Hash: 3D418271500704ABD730DF69DC81BE6B3F8EB98710F008A8EF58D9B681D7F5A9858B90

Function 00406E20 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 126memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
Part of subcall function 00402460: HeapAlloc.KERNEL32(?,00000008,004020DE,?,004020DE,?), ref: 0040247E

Part of subcall function 0040AFA0: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0040AFBD
Part of subcall function 0040AFA0: HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 0040AFCB
Part of subcall function 0040AFA0: memset.MSVCRT ref: 0040AFE8
Part of subcall function 0040AFA0: memset.MSVCRT ref: 0040B002
Part of subcall function 0040AFA0: lstrlenA.KERNEL32(?), ref: 0040B013
Part of subcall function 0040AFA0: sscanf.MSVCRT ref: 0040B02A
Part of subcall function 0040AFA0: strtok.MSVCRT ref: 0040B041
Part of subcall function 0040AFA0: _memicmp.MSVCRT ref: 0040B05B
Part of subcall function 0040AFA0: strtok.MSVCRT ref: 0040B06E
Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B09B
Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B0AD
Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B0BB
Part of subcall function 0040AFA0: lstrlenA.KERNEL32(00000000), ref: 0040B0C6
Part of subcall function 0040AFA0: HeapAlloc.KERNEL32(?,00000000,?), ref: 0040B0D5
Part of subcall function 0040AFA0: _memicmp.MSVCRT ref: 0040B0EB

strstr.MSVCRT ref: 00406EBC
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?), ref: 00406EC9
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00406EE7
HeapFree.KERNEL32(?,00000000,00000000), ref: 00406F1A
HeapFree.KERNEL32(?,00000000,?), ref: 00406F2C
HeapFree.KERNEL32(?,00000000,00000000), ref: 00406F3C

Part of subcall function 0040B160: lstrlenA.KERNEL32(00406E9C,00000000,00000000,00000000,?,?,00406E9C), ref: 0040B178
Part of subcall function 0040B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,00406E9C), ref: 0040B186
Part of subcall function 0040B160: lstrlenA.KERNEL32(00406E9C,?,?,00406E9C), ref: 0040B18F
Part of subcall function 0040B160: strstr.MSVCRT ref: 0040B19F
Part of subcall function 0040B160: strstr.MSVCRT ref: 0040B1B6
Part of subcall function 0040B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1C3
Part of subcall function 0040B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,00406E9C), ref: 0040B1D2
Part of subcall function 0040B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00406E9C), ref: 0040B1DC
Part of subcall function 0040B160: lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00406E9C), ref: 0040B1E5
Part of subcall function 0040B160: HeapFree.KERNEL32(?,00000000,00000000), ref: 0040B1F8

Part of subcall function 004101E0: memset.MSVCRT ref: 00410202
Part of subcall function 004101E0: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00410213
Part of subcall function 004101E0: EnterCriticalSection.KERNEL32(0044B4E4), ref: 00410223
Part of subcall function 004101E0: strstr.MSVCRT ref: 00410243
Part of subcall function 004101E0: lstrlenA.KERNEL32(00000000), ref: 00410254
Part of subcall function 004101E0: HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0041025F
Part of subcall function 004101E0: lstrcpyA.KERNEL32(00000000,00000000), ref: 00410272
Part of subcall function 004101E0: strstr.MSVCRT ref: 00410281
Part of subcall function 004101E0: _snprintf.MSVCRT ref: 004102C8
Part of subcall function 004101E0: strstr.MSVCRT ref: 004102EF
Part of subcall function 004101E0: HeapFree.KERNEL32(?,00000000,00000000), ref: 004103E4

Strings

POST, xrefs: 00406E5A

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heaplstrlen$Allocstrstr$Free$memset$Process_memicmpstrtok$CriticalEnterSection_snprintflstrcpylstrcpynsscanf
String ID: POST
API String ID: 836748388-1814004025
Opcode ID: 562dd2a2906666e8d5d78590dbbe1f82c56a871b10fee489a4b4aa9520b9b78c
Instruction ID: cc10cac82836c26b039bb3b82ce5bd358b0495aa14e7187af42939d2a19edcdf
Opcode Fuzzy Hash: 562dd2a2906666e8d5d78590dbbe1f82c56a871b10fee489a4b4aa9520b9b78c
Instruction Fuzzy Hash: 6331D675900205BBCB10DFA5EC85E9B776CEB84304F15417EFA09A7380DA79ED6087AE

Function 00366E20 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 126memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00362460: GetProcessHeap.KERNEL32(?,003620DE,?), ref: 0036246C
Part of subcall function 00362460: HeapAlloc.KERNEL32(?,00000008,003620DE,?,003620DE,?), ref: 0036247E

Part of subcall function 0036AFA0: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 0036AFBD
Part of subcall function 0036AFA0: HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 0036AFCB
Part of subcall function 0036AFA0: memset.MSVCRT ref: 0036AFE8
Part of subcall function 0036AFA0: memset.MSVCRT ref: 0036B002
Part of subcall function 0036AFA0: lstrlenA.KERNEL32(?), ref: 0036B013
Part of subcall function 0036AFA0: sscanf.MSVCRT ref: 0036B02A
Part of subcall function 0036AFA0: strtok.MSVCRT ref: 0036B041
Part of subcall function 0036AFA0: _memicmp.MSVCRT ref: 0036B05B
Part of subcall function 0036AFA0: strtok.MSVCRT ref: 0036B06E
Part of subcall function 0036AFA0: lstrlenA.KERNEL32(00000000), ref: 0036B09B
Part of subcall function 0036AFA0: lstrlenA.KERNEL32(00000000), ref: 0036B0AD
Part of subcall function 0036AFA0: lstrlenA.KERNEL32(00000000), ref: 0036B0BB
Part of subcall function 0036AFA0: lstrlenA.KERNEL32(00000000), ref: 0036B0C6
Part of subcall function 0036AFA0: HeapAlloc.KERNEL32(?,00000000,?), ref: 0036B0D5
Part of subcall function 0036AFA0: _memicmp.MSVCRT ref: 0036B0EB

strstr.MSVCRT ref: 00366EBC
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?), ref: 00366EC9
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00366EE7
HeapFree.KERNEL32(?,00000000,00000000), ref: 00366F1A
HeapFree.KERNEL32(?,00000000,?), ref: 00366F2C
HeapFree.KERNEL32(?,00000000,00000000), ref: 00366F3C

Part of subcall function 0036B160: lstrlenA.KERNEL32(00366E9C,00000000,00000000,00000000,?,?,00366E9C), ref: 0036B178
Part of subcall function 0036B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,00366E9C), ref: 0036B186
Part of subcall function 0036B160: lstrlenA.KERNEL32(00366E9C,?,?,00366E9C), ref: 0036B18F
Part of subcall function 0036B160: strstr.MSVCRT ref: 0036B19F
Part of subcall function 0036B160: strstr.MSVCRT ref: 0036B1B6
Part of subcall function 0036B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00366E9C), ref: 0036B1C3
Part of subcall function 0036B160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,00366E9C), ref: 0036B1D2
Part of subcall function 0036B160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,00366E9C), ref: 0036B1DC
Part of subcall function 0036B160: lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,00366E9C), ref: 0036B1E5
Part of subcall function 0036B160: HeapFree.KERNEL32(?,00000000,00000000), ref: 0036B1F8

Part of subcall function 003701E0: memset.MSVCRT ref: 00370202
Part of subcall function 003701E0: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00370213
Part of subcall function 003701E0: EnterCriticalSection.KERNEL32(003AB4E4), ref: 00370223
Part of subcall function 003701E0: strstr.MSVCRT ref: 00370243
Part of subcall function 003701E0: lstrlenA.KERNEL32(00000000), ref: 00370254
Part of subcall function 003701E0: HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 0037025F
Part of subcall function 003701E0: lstrcpyA.KERNEL32(00000000,00000000), ref: 00370272
Part of subcall function 003701E0: strstr.MSVCRT ref: 00370281
Part of subcall function 003701E0: _snprintf.MSVCRT ref: 003702C8
Part of subcall function 003701E0: strstr.MSVCRT ref: 003702EF
Part of subcall function 003701E0: HeapFree.KERNEL32(?,00000000,00000000), ref: 003703E4

Strings

POST, xrefs: 00366E5A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heaplstrlen$Allocstrstr$Free$memset$Process_memicmpstrtok$CriticalEnterSection_snprintflstrcpylstrcpynsscanf
String ID: POST
API String ID: 836748388-1814004025
Opcode ID: 93fc480bebc7651962fa53b0848c1850a07d408aae686603389932aa27244205
Instruction ID: 692bf602b77452e45e56455239784907bdf79fb597ec5bdc72c3686b25fffd5b
Opcode Fuzzy Hash: 93fc480bebc7651962fa53b0848c1850a07d408aae686603389932aa27244205
Instruction Fuzzy Hash: AB31D776900204BBCB13DFA5EC86EAF77ACEB85350F158025F9089B205DB75ED50CBA1

Function 00402F90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103injectionCOMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00402FD2
WriteProcessMemory.KERNEL32 ref: 0040301C
WriteProcessMemory.KERNEL32 ref: 00403036
WriteProcessMemory.KERNEL32 ref: 00403053

Strings

, xrefs: 00403022
g\@, xrefs: 00402FC2

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: MemoryProcess$Write$Read
String ID: $g\@
API String ID: 2454571318-100232733
Opcode ID: afba040f6b78dad9a64a69251b00c2452e7616e1452184dac7652ca053b11117
Instruction ID: df94579fe5779622c4b9a2bbeb87517a31d4cf809518c5bbba1c78cdbb14ede0
Opcode Fuzzy Hash: afba040f6b78dad9a64a69251b00c2452e7616e1452184dac7652ca053b11117
Instruction Fuzzy Hash: D2318DB2A0150DAADB10DE99DC80EEFB77CEB40751F10412AEA04E6288E775AF45C7A4

Function 00362F90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103injectionCOMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00362FD2
WriteProcessMemory.KERNEL32 ref: 0036301C
WriteProcessMemory.KERNEL32 ref: 00363036
WriteProcessMemory.KERNEL32 ref: 00363053

Strings

, xrefs: 00363022
g\6, xrefs: 00362FC2

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: MemoryProcess$Write$Read
String ID: $g\6
API String ID: 2454571318-3164584468
Opcode ID: fbc36e80b39263f23166b25f1eac621fefa91bc6881c44d4a3bae4a84a3715ab
Instruction ID: 84734083bfb273db3e7a8ac7c4cab37bed24fa0fdcfca4f0956b73c29d8026c3
Opcode Fuzzy Hash: fbc36e80b39263f23166b25f1eac621fefa91bc6881c44d4a3bae4a84a3715ab
Instruction Fuzzy Hash: BA316DB260050DAADB12DE99DC80EEFB37CEB41750F118165F90696148E771AF59C7A0

Function 0040D110 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 98stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D131
lstrcmpA.KERNEL32(?,332), ref: 0040D145
strchr.MSVCRT ref: 0040D162
lstrcpynA.KERNEL32(00000000,?,000001FF), ref: 0040D18C
lstrlenA.KERNEL32 ref: 0040D198
memmove.MSVCRT(?,?,00000000), ref: 0040D1A4

Strings

332, xrefs: 0040D13F

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrcmplstrcpynlstrlenmemmovememsetstrchr
String ID: 332
API String ID: 3300951897-3855660651
Opcode ID: 9443ea1a6c34d4dd27128972ab46630562f1943a0569a7d966f0aeca5586478e
Instruction ID: e19f26a57a8d371ee74b48060b1fbe9b9ea883c41348451d97a1bc845706ce98
Opcode Fuzzy Hash: 9443ea1a6c34d4dd27128972ab46630562f1943a0569a7d966f0aeca5586478e
Instruction Fuzzy Hash: 57310475900206BBE7209B69CC89FA77B6CEF44344F044179B909A7282EA74ED45C7B4

Function 0036D110 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 98stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036D131
lstrcmpA.KERNEL32(?,332), ref: 0036D145
strchr.MSVCRT ref: 0036D162
lstrcpynA.KERNEL32(00000000,?,000001FF), ref: 0036D18C
lstrlenA.KERNEL32 ref: 0036D198
memmove.MSVCRT(?,?,00000000), ref: 0036D1A4

Strings

332, xrefs: 0036D13F

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrcmplstrcpynlstrlenmemmovememsetstrchr
String ID: 332
API String ID: 3300951897-3855660651
Opcode ID: 5f2657c2eebf678fad5feb3b2ec57f8f0d5dcc65ead0421a3bf29b19ca24837d
Instruction ID: 81572c47e5d9c0ca1cd067c298147256335ca1e14ed6469cb3339240b821c915
Opcode Fuzzy Hash: 5f2657c2eebf678fad5feb3b2ec57f8f0d5dcc65ead0421a3bf29b19ca24837d
Instruction Fuzzy Hash: FE3108B5A00206BBE7219B28CCC9FA7776CEF44340F048164F8099B146E770ED45CBB0

Function 00407610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?), ref: 00407640
_snprintf.MSVCRT ref: 0040765C
_vsnprintf.MSVCRT ref: 0040767E
lstrcmpA.KERNEL32(?,bdns,?,?), ref: 004076A0
StrStrIA.SHLWAPI(?,00000000), ref: 004076B4

Strings

%s_, xrefs: 0040764B
bdns, xrefs: 0040769A

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: _snprintf_vsnprintflstrcmplstrlen
String ID: %s_$bdns
API String ID: 4220314296-741241040
Opcode ID: 23ec7fce3546beb37acd49c2d85190782378fbd514bc716e8a0b894e0436e7ca
Instruction ID: 788de98c1237337ff7e2880e90b2af97be5818e55d19a1934294188661e30183
Opcode Fuzzy Hash: 23ec7fce3546beb37acd49c2d85190782378fbd514bc716e8a0b894e0436e7ca
Instruction Fuzzy Hash: 08212B72B002186BD7209F69ECC5FE77358EB44714F04497AFD19E3241E675D94087E5

Function 00367610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?), ref: 00367640
_snprintf.MSVCRT ref: 0036765C
_vsnprintf.MSVCRT ref: 0036767E
lstrcmpA.KERNEL32(?,bdns,?,?), ref: 003676A0
StrStrIA.SHLWAPI(?,00000000), ref: 003676B4

Strings

bdns, xrefs: 0036769A
%s_, xrefs: 0036764B

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: _snprintf_vsnprintflstrcmplstrlen
String ID: %s_$bdns
API String ID: 4220314296-741241040
Opcode ID: 7780d8fd73e9fa098c450c1724e9cc2d417a221c408d73ef63077e79ae802981
Instruction ID: aa1474777e4f76f2a505ad83bf3dbf6cf5e348f58b39094bb370b8cdb8132549
Opcode Fuzzy Hash: 7780d8fd73e9fa098c450c1724e9cc2d417a221c408d73ef63077e79ae802981
Instruction Fuzzy Hash: 82210333600218ABEB329E6CEC84FE7736CEB44714F848569FD1CD7105E670990087E0

Function 0036F2B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00363810: GetProcessHeap.KERNEL32(00000000,00000000,?,00364046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00363819
Part of subcall function 00363810: HeapAlloc.KERNEL32(00000000,?,00364046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00363820

sprintf.MSVCRT ref: 0036F2E9
CreateFileA.KERNEL32(00000000,00000000,00000003,00000000,00000003,00000000,00000000), ref: 0036F2FA
memset.MSVCRT ref: 0036F323
DeviceIoControl.KERNEL32(00000000,002D1400,003709A7,0000000C,?,00000400,00000000,00000000), ref: 0036F352
CloseHandle.KERNEL32(00000000), ref: 0036F35B

Strings

\\.\%c:, xrefs: 0036F2E3

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$AllocCloseControlCreateDeviceFileHandleProcessmemsetsprintf
String ID: \\.\%c:
API String ID: 2995886503-1260769427
Opcode ID: 5325013f763f17556db8bd5bc0ac033215bf5d12ea737fe2390fd52abcbe3d61
Instruction ID: bfaebc873294c7f5f93ad6f6afdcf5390d71df61640c89358df370111cfb1208
Opcode Fuzzy Hash: 5325013f763f17556db8bd5bc0ac033215bf5d12ea737fe2390fd52abcbe3d61
Instruction Fuzzy Hash: D02195F19002087FE721DF989CC5EFEB77CEB45754F104579F608A6281E6B40F844AA1

Function 004081C0 Relevance: 10.6, APIs: 7, Instructions: 61networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 004081E3
socket.WS2_32(00000002,00000001,00000006), ref: 004081F9
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040820F
closesocket.WS2_32(00000000), ref: 0040821A

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Startupclosesocketioctlsocketsocket
String ID:
API String ID: 3235567692-0
Opcode ID: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
Instruction ID: 2b0dcf704551c650d29533d06b19cfcaca382403250199c2a733ecaf4d854171
Opcode Fuzzy Hash: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
Instruction Fuzzy Hash: 0301D67164031875EA20E6A59D07FFE725CCF05728F0006AAFB18BA1C1EBF95AD542DD

Function 003681C0 Relevance: 10.6, APIs: 7, Instructions: 61networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 003681E3
socket.WS2_32(00000002,00000001,00000006), ref: 003681F9
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0036820F
closesocket.WS2_32(00000000), ref: 0036821A

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Startupclosesocketioctlsocketsocket
String ID:
API String ID: 3235567692-0
Opcode ID: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
Instruction ID: 16254396924809651beff1ea8a6a145b19e0e2e1edd266c2eefe6412e20f4643
Opcode Fuzzy Hash: 99a00781a98e2d090824e08d9e6a8e1d87241bac9156ba88cfc4ef0652faaba6
Instruction Fuzzy Hash: CD012231640A18B5EA32E6A48C03FFE725CCF09720F008BA4FB1CAE4C1EBF54A048395

Function 0040A64A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 18synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0040E750,00000000,00000000,00000000), ref: 0040A659
MessageBoxA.USER32 ref: 0040A66F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040A678
ExitProcess.KERNEL32 ref: 0040A680

Strings

ngrBot Error, xrefs: 0040A661
This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!, xrefs: 0040A666

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CreateExitMessageObjectProcessSingleThreadWait
String ID: This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!$ngrBot Error
API String ID: 2697768853-1169653777
Opcode ID: ef5e2cb8f22fc0210164a191ddb43d318e3842e5a1d98e74102cfaaa7881f373
Instruction ID: dc0d325c1072b72e0d8e59aa08d1cae9c16ec156ffef70dd10597c0366fd65a5
Opcode Fuzzy Hash: ef5e2cb8f22fc0210164a191ddb43d318e3842e5a1d98e74102cfaaa7881f373
Instruction Fuzzy Hash: 22E06735BC5351B7E62017A05D0BFC429249B08F52F218661B315FE4E0C6E42190475D

Function 0036A64A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 18synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0036E750,00000000,00000000,00000000), ref: 0036A659
MessageBoxA.USER32 ref: 0036A66F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0036A678
ExitProcess.KERNEL32 ref: 0036A680

Strings

ngrBot Error, xrefs: 0036A661
This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!, xrefs: 0036A666

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CreateExitMessageObjectProcessSingleThreadWait
String ID: This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!$ngrBot Error
API String ID: 2697768853-1169653777
Opcode ID: 319ebe08d38caa3c9c798332a554056912fb04d0de90b7bdefe213ae71aa081d
Instruction ID: 63999540bd792ed753e1420c3cb228ac651cae3c2a7ec816526a9610de55d4c6
Opcode Fuzzy Hash: 319ebe08d38caa3c9c798332a554056912fb04d0de90b7bdefe213ae71aa081d
Instruction Fuzzy Hash: C5E09E367D4351B7E67317A45D0FFC536589B04F12F214600F32DBD0D49AD421C04759

Function 00407330 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407351
lstrlenA.KERNEL32(?), ref: 00407369
_snprintf.MSVCRT ref: 00407381
_vsnprintf.MSVCRT ref: 004073A3
lstrlenA.KERNEL32(00000000), ref: 004073B2

Strings

%s_, xrefs: 00407370

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$_snprintf_vsnprintfmemset
String ID: %s_
API String ID: 3230270962-1040268105
Opcode ID: 7dd372d5851a64b1621396c9dfdd56531f0907fab683194608e6fb6fd50729dd
Instruction ID: 5826c9583f370a1dd932e8f72a1f935f9ca8b57465acbcc929005ef802fb48eb
Opcode Fuzzy Hash: 7dd372d5851a64b1621396c9dfdd56531f0907fab683194608e6fb6fd50729dd
Instruction Fuzzy Hash: 3B114CB2A4031937F720E6698C86FF7736CDF84700F0405BDBE1853182E5B49E4087A4

Function 00367330 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00367351
lstrlenA.KERNEL32(?), ref: 00367369
_snprintf.MSVCRT ref: 00367381
_vsnprintf.MSVCRT ref: 003673A3
lstrlenA.KERNEL32(00000000), ref: 003673B2

Strings

%s_, xrefs: 00367370

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$_snprintf_vsnprintfmemset
String ID: %s_
API String ID: 3230270962-1040268105
Opcode ID: bcf893b7db30a069d51f0e2843565e782ef5ea78ce021f5905103030c7406fc5
Instruction ID: b96222c4dd8e47ac36bac6709cde971cd6a4a41b79cfb9425b0dadd1a0c0cac7
Opcode Fuzzy Hash: bcf893b7db30a069d51f0e2843565e782ef5ea78ce021f5905103030c7406fc5
Instruction Fuzzy Hash: DB112F7694031977E731E6589C86FF7736CDF84750F0445A8F91C6B281E5B49E0087E0

Function 004102A9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 57memorystringCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 004102C8
strstr.MSVCRT ref: 004102EF
atoi.MSVCRT(00000000,?,http,int), ref: 00410322
lstrlenA.KERNEL32(00000000), ref: 00410386
HeapFree.KERNEL32(?,00000000,00000000), ref: 004103E4
HeapFree.KERNEL32(?,00000000,00000000), ref: 004103EE
LeaveCriticalSection.KERNEL32(0044B4E4), ref: 004103FD
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041041F

Strings

%s=, xrefs: 004102B7

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: FreeHeap$CriticalLeaveSection_snprintfatoilstrlenstrstr
String ID: %s=
API String ID: 1805118874-2646424381
Opcode ID: ee71abe191ac5c5f67e6a76e53e66d7266845c4f9d38bb18f3292e0e6c04068d
Instruction ID: 18d3edc493bc3f403bf92720d977da1dbff54a17adae19d127435001e8f83a82
Opcode Fuzzy Hash: ee71abe191ac5c5f67e6a76e53e66d7266845c4f9d38bb18f3292e0e6c04068d
Instruction Fuzzy Hash: CC11A971A4031DABDB209751CC81BFBB378EB84305F14416BEE1963240DAB8FDC18BA9

Function 003702A9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 57memorystringCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 003702C8
strstr.MSVCRT ref: 003702EF
atoi.MSVCRT(00000000,?,http,int), ref: 00370322
lstrlenA.KERNEL32(00000000), ref: 00370386
HeapFree.KERNEL32(?,00000000,00000000), ref: 003703E4
HeapFree.KERNEL32(?,00000000,00000000), ref: 003703EE
LeaveCriticalSection.KERNEL32(003AB4E4), ref: 003703FD
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0037041F

Strings

%s=, xrefs: 003702B7

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: FreeHeap$CriticalLeaveSection_snprintfatoilstrlenstrstr
String ID: %s=
API String ID: 1805118874-2646424381
Opcode ID: fc0c17e4cbced1a9d059582ba3d907fd934f31465bfa82913651592296cd72fb
Instruction ID: df359d3c6ccf50b77b921fd9942466837951e6e208e81b0e8083957c29fa71f7
Opcode Fuzzy Hash: fc0c17e4cbced1a9d059582ba3d907fd934f31465bfa82913651592296cd72fb
Instruction Fuzzy Hash: 9A11E976A40609EBEB368751CC81FBAB378EB84310F148469FA1D67140DB78BD418F90

Function 0040DD20 Relevance: 9.0, APIs: 6, Instructions: 36sleepthreadnetworkCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 0040DD2A
GetTickCount.KERNEL32 ref: 0040DD31
InitializeCriticalSection.KERNEL32(0044A6C8), ref: 0040DD45
Sleep.KERNEL32(00007530), ref: 0040DD6A
WSACleanup.WS2_32 ref: 0040DD98

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CleanupCountCriticalExitInitializeSectionSleepThreadTick
String ID:
API String ID: 544336047-0
Opcode ID: 45cafbe1ea53cd53aec28c77d21da2276e5172413c87d9c6706ecdba95742d04
Instruction ID: 7f0fa1591e1ee0be880222c6a73bc66ebc889f5a3643ae2c22fe3d04a35b960a
Opcode Fuzzy Hash: 45cafbe1ea53cd53aec28c77d21da2276e5172413c87d9c6706ecdba95742d04
Instruction Fuzzy Hash: 81F090B1D4061466D7203BF97D096AE36545F14329B204A37FB15E22F0EB3C89458AAE

Function 0036DD20 Relevance: 9.0, APIs: 6, Instructions: 36sleepthreadnetworkCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 0036DD2A
GetTickCount.KERNEL32 ref: 0036DD31
InitializeCriticalSection.KERNEL32(003AA6C8), ref: 0036DD45
Sleep.KERNEL32(00007530), ref: 0036DD6A
WSACleanup.WS2_32 ref: 0036DD98

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CleanupCountCriticalExitInitializeSectionSleepThreadTick
String ID:
API String ID: 544336047-0
Opcode ID: deef3c340394b5666e779a3e9e7f720e5270d1d8cce06f407227b413134fdd78
Instruction ID: dddf8594d11a6f97f2b073f21ee2d1a9fe44775c8454e94e1be6d03f8b306aa9
Opcode Fuzzy Hash: deef3c340394b5666e779a3e9e7f720e5270d1d8cce06f407227b413134fdd78
Instruction Fuzzy Hash: 03F0BB72F00A1456C6333BBD7D0E56D32585F12364F158611F719C69F8EB3485C089A2

Function 00364560 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 003645D5
CreateFileMappingA.KERNEL32 ref: 003645FD
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,?,?,00010000,EDB88320,00000000), ref: 00364636

Strings

%s_%d, xrefs: 003645C4

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: File$CreateMappingView_snprintf
String ID: %s_%d
API String ID: 1261873476-1933919280
Opcode ID: 655d39e16036209100fdf60239a7479dfcaab393c8c4ab7aaf9c1f64f500b9d7
Instruction ID: 9cf9399482b06dbd1cc9f88a778be39e2a718cb70cb8b37003d6ba17ee2f108d
Opcode Fuzzy Hash: 655d39e16036209100fdf60239a7479dfcaab393c8c4ab7aaf9c1f64f500b9d7
Instruction Fuzzy Hash: DB61E3726106028FD326CF18C885BB5B7E5FF84304F28817DE6868B385D779A9A4DB80

Function 0040E4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79sleepmemorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A013
Part of subcall function 00409FF0: strtok.MSVCRT ref: 0040A04F

lstrlenA.KERNEL32(?), ref: 0040E517
_memicmp.MSVCRT ref: 0040E525
Sleep.KERNEL32(000003E8), ref: 0040E54E
HeapFree.KERNEL32(?,00000000,?), ref: 0040E57A

Strings

[Login]: %s, xrefs: 0040E50B, 0040E536

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: strtok$FreeHeapSleep_memicmplstrlen
String ID: [Login]: %s
API String ID: 2470415281-2266835287
Opcode ID: dbf4343face418a870bb8425e8e66a13a343c3042656d238115fe0c3f70b93bf
Instruction ID: 783aa63cf0ce7d9ff363f5601bd85304eb0c082eb699b2ee8fe1f1afe810e237
Opcode Fuzzy Hash: dbf4343face418a870bb8425e8e66a13a343c3042656d238115fe0c3f70b93bf
Instruction Fuzzy Hash: EC21DAB1640204BBD720DB96DD81FAB77ACDB84745F10483AF904533C1E7BD9D61C6A9

Function 0036E4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79sleepmemorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00369FF0: strtok.MSVCRT ref: 0036A013
Part of subcall function 00369FF0: strtok.MSVCRT ref: 0036A04F

lstrlenA.KERNEL32(?), ref: 0036E517
_memicmp.MSVCRT ref: 0036E525
Sleep.KERNEL32(000003E8), ref: 0036E54E
HeapFree.KERNEL32(?,00000000,?), ref: 0036E57A

Strings

[Login]: %s, xrefs: 0036E50B, 0036E536

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: strtok$FreeHeapSleep_memicmplstrlen
String ID: [Login]: %s
API String ID: 2470415281-2266835287
Opcode ID: 33f3136c634fc41f62c91a9feff0bbc602e049353e4031ba6289e58ea1357173
Instruction ID: cfe6a38307e7c6637bec1a40e321d5810d88761d796b4440ef52b71919815c8e
Opcode Fuzzy Hash: 33f3136c634fc41f62c91a9feff0bbc602e049353e4031ba6289e58ea1357173
Instruction Fuzzy Hash: 132108B6500204ABD732DB58DC86FAB73ACEB45714F15C418FA094B245F7B5ED44CBA1

Function 00401C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW), ref: 00401C6E

Part of subcall function 00403750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 0040376B

WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00401CC6
CloseHandle.KERNEL32(00000000), ref: 00401CD9

Strings

CreateFileW, xrefs: 00401C64
kernel32.dll, xrefs: 00401C69

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Handle$AddressCloseFileModuleProcedureWrite
String ID: CreateFileW$kernel32.dll
API String ID: 2185083974-2113957990
Opcode ID: 8a3a0deed9bbcea85a1b6a89db91e2350229aa1256e8c9d6a1a26e2b90d2296e
Instruction ID: 3516dd70821b321a82e3fccae0f5f19e3dd812fe4f74b4804ac45d1edfcd853e
Opcode Fuzzy Hash: 8a3a0deed9bbcea85a1b6a89db91e2350229aa1256e8c9d6a1a26e2b90d2296e
Instruction Fuzzy Hash: FA012BB16441187FE7049F68DC85FEB735DAB49714F148239FA15A32E0D2B49D0553A8

Function 00361C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW), ref: 00361C6E

Part of subcall function 00363750: LdrGetProcedureAddress.NTDLL(?,00000000,00000000,?), ref: 0036376B

WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00361CC6
CloseHandle.KERNEL32(00000000), ref: 00361CD9

Strings

kernel32.dll, xrefs: 00361C69
CreateFileW, xrefs: 00361C64

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Handle$AddressCloseFileModuleProcedureWrite
String ID: CreateFileW$kernel32.dll
API String ID: 2185083974-2113957990
Opcode ID: 5175f491e86878ffe8f25cd02e848e932733e971e38d4c411600235d3f5db5a9
Instruction ID: 53f175d369ab480de3b7e4148c3814d9c3c7c1a90066783c2173fe9070ab0dd5
Opcode Fuzzy Hash: 5175f491e86878ffe8f25cd02e848e932733e971e38d4c411600235d3f5db5a9
Instruction Fuzzy Hash: 680108B2A402147FD7159E6D9C8AFEF335D9B45324F15C218F919972C0D6705D4483A0

Function 00406D90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,00406C55,00000000), ref: 00406DA1

Strings

ntdll.dll, xrefs: 00406D95
NtSetInformationProcess, xrefs: 00406DC4
NtQueryInformationProcess, xrefs: 00406DB9
Ul@, xrefs: 00406DDB, 00406DE9

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: HandleModule
String ID: NtQueryInformationProcess$NtSetInformationProcess$Ul@$ntdll.dll
API String ID: 4139908857-2971258217
Opcode ID: 62a2a73916b9af1f8daf532ab0fdb30c97b42ff7dfa5a627ce04c4475a55d3f5
Instruction ID: e665a3cd0ad87b6e4d351724504253e06bb2307510cb7435dea9c92ab51fd615
Opcode Fuzzy Hash: 62a2a73916b9af1f8daf532ab0fdb30c97b42ff7dfa5a627ce04c4475a55d3f5
Instruction Fuzzy Hash: 8E01D4B234131837EA205A49DC45FEB779CCB85769F010167FE08B72C0DAB99D4082E8

Function 00366D90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,00366C55,00000000), ref: 00366DA1

Strings

NtQueryInformationProcess, xrefs: 00366DB9
Ul6, xrefs: 00366DDB, 00366DE9
ntdll.dll, xrefs: 00366D95
NtSetInformationProcess, xrefs: 00366DC4

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: HandleModule
String ID: NtQueryInformationProcess$NtSetInformationProcess$Ul6$ntdll.dll
API String ID: 4139908857-2811123161
Opcode ID: 5fd636623081ad5c6746a1ce7be883d8c68ddfb55d15ceed93d87562152ce491
Instruction ID: 919aabcb657efc3160e91a43329e1d5cee3d4597fc80562b609242bd3a539148
Opcode Fuzzy Hash: 5fd636623081ad5c6746a1ce7be883d8c68ddfb55d15ceed93d87562152ce491
Instruction Fuzzy Hash: 500184B274161837EA32595D9C46FEA739CCB86779F018156FE08AB284DAA59D0082E1

Function 0040FAA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 0040FAC0
sprintf.MSVCRT ref: 0040FAF9

Strings

%c:\, xrefs: 0040FAF3
@WA, xrefs: 0040FB24
[USB]: Infected %s, xrefs: 0040FB31

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ProcWindowsprintf
String ID: %c:\$@WA$[USB]: Infected %s
API String ID: 3179433310-3310510632
Opcode ID: fd5a5e364699ce4a0fdc81f4504cbf464797e88720b1db6411780ffb4476f92d
Instruction ID: 02eb9736952d2a2b4b7c1167389122037410bde8fc9acd6e29a5ba8690f26e1d
Opcode Fuzzy Hash: fd5a5e364699ce4a0fdc81f4504cbf464797e88720b1db6411780ffb4476f92d
Instruction Fuzzy Hash: 6111E7B55001085BC720DF64DC41EBB737CEB44308F04857EFE05A2282E639E9558B69

Function 0036FAA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 0036FAC0
sprintf.MSVCRT ref: 0036FAF9

Strings

%c:\, xrefs: 0036FAF3
@W7, xrefs: 0036FB24
[USB]: Infected %s, xrefs: 0036FB31

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ProcWindowsprintf
String ID: %c:\$@W7$[USB]: Infected %s
API String ID: 3179433310-2394137797
Opcode ID: f543c488bb0884bdc4adc060a152600484997cbc20d7aedcb432ecc3a0c38227
Instruction ID: ea1b93b6b24bb468e43115b7495a5c73d6d85e8c6f414671986e278512830218
Opcode Fuzzy Hash: f543c488bb0884bdc4adc060a152600484997cbc20d7aedcb432ecc3a0c38227
Instruction Fuzzy Hash: 7411E3B65001085FCB25DF68EC52EBB736CEB44304F04C968FE0997246EA31D951CF61

Function 0040D530 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040D5E4

Part of subcall function 00408F50: ApplyControlToken.SECUR32(?,?), ref: 00408FB5
Part of subcall function 00408F50: InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00408FF9
Part of subcall function 00408F50: DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00409025
Part of subcall function 00408F50: FreeCredentialsHandle.SECUR32(?), ref: 0040902F

Sleep.KERNEL32(0000000F), ref: 0040D659

Strings

%s:%d, xrefs: 0040D5CD
VA, xrefs: 0040D55C, 0040D5FC
cnc, xrefs: 0040D5D2

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: ContextSecuritySleep$ApplyControlCredentialsDeleteFreeHandleInitializeToken
String ID: %s:%d$cnc$VA
API String ID: 3241915987-2824176248
Opcode ID: 20c79ff23815496d10ba28f53a97e5ef7eb88f931315f02d53633f4a8f91e0ef
Instruction ID: 3fba86e59980fe9d4d7b2036a9b00bfb261980af2cf933dbcae5c76902665172
Opcode Fuzzy Hash: 20c79ff23815496d10ba28f53a97e5ef7eb88f931315f02d53633f4a8f91e0ef
Instruction Fuzzy Hash: 6C41D6B5E00104EBC710EBD9DC819AEB3B9EB84318F14457AFD09E7391DA35ED0487A9

Function 0036D530 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0036D5E4

Part of subcall function 00368F50: ApplyControlToken.SECUR32(?,?), ref: 00368FB5
Part of subcall function 00368F50: InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00368FF9
Part of subcall function 00368F50: DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00369025
Part of subcall function 00368F50: FreeCredentialsHandle.SECUR32(?), ref: 0036902F

Sleep.KERNEL32(0000000F), ref: 0036D659

Strings

%s:%d, xrefs: 0036D5CD
V7, xrefs: 0036D55C, 0036D5FC
cnc, xrefs: 0036D5D2

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: ContextSecuritySleep$ApplyControlCredentialsDeleteFreeHandleInitializeToken
String ID: %s:%d$cnc$V7
API String ID: 3241915987-288577137
Opcode ID: a166691f6ed2eb12e9b610c35a9c4949241980e87640e2064536707b2c0be8fe
Instruction ID: 672eb53ee4bf5a25192f836364db1fe4fc185d56af003a34fe7ae0075d99e68c
Opcode Fuzzy Hash: a166691f6ed2eb12e9b610c35a9c4949241980e87640e2064536707b2c0be8fe
Instruction Fuzzy Hash: F241E3B6E00104ABC726DB99EC819AEB3BDEB85314F158165F909DB30ADB71ED4087A1

Function 004016F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0040170E
lstrcmpA.KERNEL32(00000000,block), ref: 00401754
strstr.MSVCRT ref: 00401764

Strings

block, xrefs: 0040174E
bdns, xrefs: 00401727, 004017A0

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: strstr$lstrcmp
String ID: bdns$block
API String ID: 142677638-4143068083
Opcode ID: 16de161929d562d1a81be2ce0f5dc1ee04b4dd39fc5185927e1aa3bde43099bf
Instruction ID: 124088c1a3f70e1cbae084184767cd66ed6bf528bf03336b987e05220ac7cc48
Opcode Fuzzy Hash: 16de161929d562d1a81be2ce0f5dc1ee04b4dd39fc5185927e1aa3bde43099bf
Instruction Fuzzy Hash: 9121B0766012086BDB10DF49AC85EFB736CDB88711F14812BFD05E3291E778ED5186BA

Function 003616F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0036170E
lstrcmpA.KERNEL32(00000000,block), ref: 00361754
strstr.MSVCRT ref: 00361764

Strings

bdns, xrefs: 00361727, 003617A0
block, xrefs: 0036174E

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: strstr$lstrcmp
String ID: bdns$block
API String ID: 142677638-4143068083
Opcode ID: 49719317cb468a0ae38202d6bfdad452ab49506c180a23054aaaa2580947ecda
Instruction ID: 555bcffc5ca8faf6e183e2b3b2150bae9b22eb1b3f3732b71f3e01d6e7c93e47
Opcode Fuzzy Hash: 49719317cb468a0ae38202d6bfdad452ab49506c180a23054aaaa2580947ecda
Instruction Fuzzy Hash: 3821C4766012086B9B22DE59EC86DBB736CDB88711F08C119FC09D7201E774ED1487F1

Function 00407E20 Relevance: 7.6, APIs: 5, Instructions: 65networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000103A), ref: 00407E2C
socket.WS2_32(00000002,00000001,00000006), ref: 00407E63
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00407E7A
connect.WS2_32(?,00000008,00000010), ref: 00407E8B

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: AllocLocalconnectioctlsocketsocket
String ID:
API String ID: 3721573447-0
Opcode ID: 6a0cf34466a604d09193a111f7b2e156c19cd74b9b825a2281b43bf372efd1ff
Instruction ID: 8573ccf17625dbd4e70cb95bd4ecb179e2b8f2d801530163547a45014eaf0546
Opcode Fuzzy Hash: 6a0cf34466a604d09193a111f7b2e156c19cd74b9b825a2281b43bf372efd1ff
Instruction Fuzzy Hash: E811D631A00304ABC720DF59D805AD6B7A8DB49724F00469AFA59DB3D1D2B169908794

Function 00367E20 Relevance: 7.6, APIs: 5, Instructions: 65networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000103A), ref: 00367E2C
socket.WS2_32(00000002,00000001,00000006), ref: 00367E63
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00367E7A
connect.WS2_32(?,00000008,00000010), ref: 00367E8B

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: AllocLocalconnectioctlsocketsocket
String ID:
API String ID: 3721573447-0
Opcode ID: 10c2d2c5d31b4b5f38ae8fd0baf6be88ba34f547113950efd8f6941bd99097e7
Instruction ID: e83f810f3307b80f796c94b4d89c6e623e78c13480129eae9bf5b50f242efe01
Opcode Fuzzy Hash: 10c2d2c5d31b4b5f38ae8fd0baf6be88ba34f547113950efd8f6941bd99097e7
Instruction Fuzzy Hash: 5911E631A00704AFC730DF68D849ED6B7A8EF49724F00869AFA5DDB391D2B1A8548790

Function 0040E770 Relevance: 7.6, APIs: 5, Instructions: 50registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0040E77C
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000012,?), ref: 0040E793
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 0040E7B5
RegNotifyChangeKeyValue.ADVAPI32 ref: 0040E7C3
RegCloseKey.ADVAPI32(?), ref: 0040E7D1

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Value$ChangeCloseNotifyOpenlstrlen
String ID:
API String ID: 2592630252-0
Opcode ID: af4cde93d3db90eb8642d8f6f32dd5aa766a189061079ea768f5a47468b3961d
Instruction ID: 817f0236f2bd820b7f614add4cf1e09f77a3d0cd335360597150fdbb8a11f275
Opcode Fuzzy Hash: af4cde93d3db90eb8642d8f6f32dd5aa766a189061079ea768f5a47468b3961d
Instruction Fuzzy Hash: BF011A75740304BFE720CF65DC89F977BACEB88B50F10C429BB499B690D674E8408B68

Function 0036E770 Relevance: 7.6, APIs: 5, Instructions: 50registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0036E77C
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000012,?), ref: 0036E793
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 0036E7B5
RegNotifyChangeKeyValue.ADVAPI32 ref: 0036E7C3
RegCloseKey.ADVAPI32(?), ref: 0036E7D1

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Value$ChangeCloseNotifyOpenlstrlen
String ID:
API String ID: 2592630252-0
Opcode ID: 71613d8df9322482468eb674335943dd637ea3684389d1b6b429199d298963fe
Instruction ID: 2c85a111577bb5bad62c448310fb158792a7921f66f3c1140621e4e5120b58e8
Opcode Fuzzy Hash: 71613d8df9322482468eb674335943dd637ea3684389d1b6b429199d298963fe
Instruction Fuzzy Hash: 5A01DE76350344BFE730CB69DC85F9777ACEB88B50F108419BA499B680D675E8809B64

Function 00407700 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040771E
_snprintf.MSVCRT ref: 00407738
lstrlenA.KERNEL32(00000000), ref: 00407747

Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C

lstrcmpA.KERNEL32(00000000,00411A30), ref: 0040777F

Strings

state_%s, xrefs: 00407727

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait_snprintflstrcmplstrlenmemset
String ID: state_%s
API String ID: 1716770999-3670522127
Opcode ID: 235272e43844a436d13b728baab66befe5b0e802e7c81055b935bd28c73822a3
Instruction ID: 2cd1af118f2aaba9ee0144bd5bb7b35bf02337a9ecf34d3b98cb7566c03369e6
Opcode Fuzzy Hash: 235272e43844a436d13b728baab66befe5b0e802e7c81055b935bd28c73822a3
Instruction Fuzzy Hash: 0C01DBF5A903087BDB10F7A4DE0BFF9736C9B44704F0045E9B719A2082F5B46A448799

Function 00367700 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036771E
_snprintf.MSVCRT ref: 00367738
lstrlenA.KERNEL32(00000000), ref: 00367747

Part of subcall function 00364900: WaitForSingleObject.KERNEL32(00367495,000000FF,?,00000000,756F59EB,?,00367495), ref: 00364939
Part of subcall function 00364900: ReleaseMutex.KERNEL32(?,?,00367495), ref: 0036497C

lstrcmpA.KERNEL32(00000000,00371A30), ref: 0036777F

Strings

state_%s, xrefs: 00367727

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait_snprintflstrcmplstrlenmemset
String ID: state_%s
API String ID: 1716770999-3670522127
Opcode ID: 52643eb95f64d567a635d13d37d1b6d9466f33161a3cec5df7e5f86bb5de1245
Instruction ID: db7228121507ce2399d7bd12aa91f4cbac28bedde2d871d9c20ec24077593767
Opcode Fuzzy Hash: 52643eb95f64d567a635d13d37d1b6d9466f33161a3cec5df7e5f86bb5de1245
Instruction Fuzzy Hash: 5101FEB69503087ADB25F6A4DD0BFF973AC8B44704F40C5D4FA1DE6081F5B45A544B90

Function 004050F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 0040510F
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00405122
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040512B

Strings

%s-comm, xrefs: 004050FE

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CreateMutexObjectSingleWait_snprintf
String ID: %s-comm
API String ID: 3057366584-1028030816
Opcode ID: a93b1516683958c1d9d60c9ee514b9fb12ccde5092aeeca8bbe9916ea1720a1c
Instruction ID: 467e8c21684c0235fe829960707385420c5f419fa334f9ea544b7238d55dbfde
Opcode Fuzzy Hash: a93b1516683958c1d9d60c9ee514b9fb12ccde5092aeeca8bbe9916ea1720a1c
Instruction Fuzzy Hash: 44210875A802047BE714DF91CC46FEB3328B784706F1409AAF504A72D2E6B89E44DBA8

Function 003650F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 0036510F
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00365122
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0036512B

Strings

%s-comm, xrefs: 003650FE

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CreateMutexObjectSingleWait_snprintf
String ID: %s-comm
API String ID: 3057366584-1028030816
Opcode ID: 960aadf89982522ef0b9c9624a0620d23d9c0cb866200c7825bdfd5789247b34
Instruction ID: 888e425b904f19f39087ee86c3fd34e49c3e679b83eb9e9027e10f52aa2ab210
Opcode Fuzzy Hash: 960aadf89982522ef0b9c9624a0620d23d9c0cb866200c7825bdfd5789247b34
Instruction Fuzzy Hash: 06213672A80208BBD716DB54DC42FEB332CEB81711F158A56F504BB2C2EA70DA44CBA0

Function 00405070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 0040508F
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 004050A2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004050AB

Strings

%s-pid, xrefs: 0040507E

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CreateMutexObjectSingleWait_snprintf
String ID: %s-pid
API String ID: 3057366584-2694366501
Opcode ID: ff6920a4f34576960947fc1b5a3d0ac86d7dd6ac261b0cca6cf284f5e966243f
Instruction ID: 655e5f0feb57342864bd118bf9991db32f12074da84674c84bcde0045b314480
Opcode Fuzzy Hash: ff6920a4f34576960947fc1b5a3d0ac86d7dd6ac261b0cca6cf284f5e966243f
Instruction Fuzzy Hash: C9F052F0A4030467EB20A7B09C8BFDB3218D310711F10067BF714B22E0E9F88AC08AAD

Function 00365070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 0036508F
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 003650A2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003650AB

Strings

%s-pid, xrefs: 0036507E

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CreateMutexObjectSingleWait_snprintf
String ID: %s-pid
API String ID: 3057366584-2694366501
Opcode ID: 3424791592088aae3a2a1caab2587e50558002dcfcf265069e37afb30e08b7ce
Instruction ID: ec8ef4cb54789c9c04655a3a07dd06083f9e6553e6a5f96ceecd191b7b7eb2fb
Opcode Fuzzy Hash: 3424791592088aae3a2a1caab2587e50558002dcfcf265069e37afb30e08b7ce
Instruction Fuzzy Hash: A9F0E2B2A50208A7EB22A7749C8BF96326C9710711F108666F718A61C4E9B58AC48AA1

Function 0040D760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00407700: memset.MSVCRT ref: 0040771E
Part of subcall function 00407700: _snprintf.MSVCRT ref: 00407738
Part of subcall function 00407700: lstrlenA.KERNEL32(00000000), ref: 00407747

Sleep.KERNEL32(00001388), ref: 0040D78A
Sleep.KERNEL32(00002710), ref: 0040D795
ExitProcess.KERNEL32 ref: 0040D799

Strings

bsod, xrefs: 0040D770

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Sleep$ExitProcess_snprintflstrlenmemset
String ID: bsod
API String ID: 706155222-1315366068
Opcode ID: 5388deed1a02275c41a8fd53f22eb3b9fef4c2e063f1b81cc4663499f754aae8
Instruction ID: 29af33aa6d3d1f262d87ea6fb0a6dfe9123b99fa97d7c71365f1f2103470005d
Opcode Fuzzy Hash: 5388deed1a02275c41a8fd53f22eb3b9fef4c2e063f1b81cc4663499f754aae8
Instruction Fuzzy Hash: 77D05E71D84230A3D22123A56C0AF8B59209F40F61F164232EA05BB5E0C5A8298684EE

Function 0036D760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00367700: memset.MSVCRT ref: 0036771E
Part of subcall function 00367700: _snprintf.MSVCRT ref: 00367738
Part of subcall function 00367700: lstrlenA.KERNEL32(00000000), ref: 00367747

Sleep.KERNEL32(00001388), ref: 0036D78A
Sleep.KERNEL32(00002710), ref: 0036D795
ExitProcess.KERNEL32 ref: 0036D799

Strings

bsod, xrefs: 0036D770

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Sleep$ExitProcess_snprintflstrlenmemset
String ID: bsod
API String ID: 706155222-1315366068
Opcode ID: a0fd5bf2ebf4530a77b98c455f3b5272493f2fc3dc76b1516cf7e70036dace40
Instruction ID: f3e2d958bb690e665032387763d646ec105b4383e61970dd9fbcc2d3b0047112
Opcode Fuzzy Hash: a0fd5bf2ebf4530a77b98c455f3b5272493f2fc3dc76b1516cf7e70036dace40
Instruction Fuzzy Hash: 80D05EB2A9423063D233276A1C0AF5B59689F40F61F468210E909AB5988595698184E6

Function 0040E840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00407330: memset.MSVCRT ref: 00407351
Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2

CreateThread.KERNEL32(00000000,00000000,Function_0000D760,00000000,00000000,00000000), ref: 0040E861
CloseHandle.KERNEL32(00000000), ref: 0040E868

Strings

admin, xrefs: 0040E845
isadmin, xrefs: 0040E840

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$CloseCreateHandleThread_snprintf_vsnprintfmemset
String ID: admin$isadmin
API String ID: 3136305548-1977506819
Opcode ID: 8b8f0a5b3d5e5b2fa0b53b3b26b7233dacb213c356718c0c7739795dadb7a47b
Instruction ID: 3b6143c26c68504e08692baad0537c2f2dacd248f620d2e63fa73881cbd2d311
Opcode Fuzzy Hash: 8b8f0a5b3d5e5b2fa0b53b3b26b7233dacb213c356718c0c7739795dadb7a47b
Instruction Fuzzy Hash: 66D0E975BD5340B6F56027A05E0FF4965545728F06F208432BB05F91D1E6E8709455AD

Function 0036E840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00367330: memset.MSVCRT ref: 00367351
Part of subcall function 00367330: lstrlenA.KERNEL32(?), ref: 00367369
Part of subcall function 00367330: _snprintf.MSVCRT ref: 00367381
Part of subcall function 00367330: _vsnprintf.MSVCRT ref: 003673A3
Part of subcall function 00367330: lstrlenA.KERNEL32(00000000), ref: 003673B2

CreateThread.KERNEL32(00000000,00000000,Function_0000D760,00000000,00000000,00000000), ref: 0036E861
CloseHandle.KERNEL32(00000000), ref: 0036E868

Strings

isadmin, xrefs: 0036E840
admin, xrefs: 0036E845

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$CloseCreateHandleThread_snprintf_vsnprintfmemset
String ID: admin$isadmin
API String ID: 3136305548-1977506819
Opcode ID: 57f7f2dc3323355822e39b8ba528c58f351f3f1db7047b6f3c70ba5457c83b17
Instruction ID: b107a2e10d2fb19f7efaea747b012742f6e31fcdf6c0b367857be0add983cbcc
Opcode Fuzzy Hash: 57f7f2dc3323355822e39b8ba528c58f351f3f1db7047b6f3c70ba5457c83b17
Instruction Fuzzy Hash: 0ED0C9B67D434176F13327A05D0FF4A22485724F06F608410F708AD1C5A5D4209045AA

Function 00402880 Relevance: 6.2, APIs: 4, Instructions: 164networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00402460: GetProcessHeap.KERNEL32(?,004020DE,?), ref: 0040246C
Part of subcall function 00402460: HeapAlloc.KERNEL32(?,00000008,004020DE,?,004020DE,?), ref: 0040247E

inet_addr.WS2_32(?), ref: 004028BE
DnsQuery_A.DNSAPI(?,00000001,00000008,00000000,?,00000000), ref: 00402939
_stricmp.MSVCRT(?,?,?), ref: 0040294E
DnsFree.DNSAPI(?,00000001), ref: 004029D9

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Heap$AllocFreeProcessQuery__stricmpinet_addr
String ID:
API String ID: 3002912770-0
Opcode ID: a5b975686055a6ad762db3198c48b653122c65071bde79865f0daa47f409934a
Instruction ID: 7b4bcac95eda314589689d5efbf7f5d85f6b8a6c39ee2f63de8762e6eb4cb817
Opcode Fuzzy Hash: a5b975686055a6ad762db3198c48b653122c65071bde79865f0daa47f409934a
Instruction Fuzzy Hash: 865190B07002049FD720DF69CA89B6AB3A5AF85704F20447EE585AB3C0E7B9AD41CB95

Function 00362880 Relevance: 6.2, APIs: 4, Instructions: 164networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00362460: GetProcessHeap.KERNEL32(?,003620DE,?), ref: 0036246C
Part of subcall function 00362460: HeapAlloc.KERNEL32(?,00000008,003620DE,?,003620DE,?), ref: 0036247E

inet_addr.WS2_32(?), ref: 003628BE
DnsQuery_A.DNSAPI(?,00000001,00000008,00000000,?,00000000), ref: 00362939
_stricmp.MSVCRT(?,?,?), ref: 0036294E
DnsFree.DNSAPI(?,00000001), ref: 003629D9

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Heap$AllocFreeProcessQuery__stricmpinet_addr
String ID:
API String ID: 3002912770-0
Opcode ID: 128c85f33ad911fe7a03449ef6004437af08643368f8472f6286ec65596a95c8
Instruction ID: 00c3ba536de1955ddffff6f271b909699f91df514c0fd8375ffa0fd9ae3b76c2
Opcode Fuzzy Hash: 128c85f33ad911fe7a03449ef6004437af08643368f8472f6286ec65596a95c8
Instruction Fuzzy Hash: B951C170600A009FD722DF59C881B6BB7F5FF86704F228459E9899B388EB71ED51CB91

Function 00408F50 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

ApplyControlToken.SECUR32(?,?), ref: 00408FB5
InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00408FF9
DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00409025
FreeCredentialsHandle.SECUR32(?), ref: 0040902F

Part of subcall function 00408760: FreeContextBuffer.SECUR32(?), ref: 00408774

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Context$FreeSecurity$ApplyBufferControlCredentialsDeleteHandleInitializeToken
String ID:
API String ID: 362823901-0
Opcode ID: 2380779ca4936bf24da35008e120283aa08c8bc45cf506c596155f6e4fe055a8
Instruction ID: 597c2a7369eb59e50f1a6720c39724f21d20c383529a429c7ed2b113d5fceb98
Opcode Fuzzy Hash: 2380779ca4936bf24da35008e120283aa08c8bc45cf506c596155f6e4fe055a8
Instruction Fuzzy Hash: 3141D9B1C002099BCB10DF9AC9859EEFBFCFF98304F10851EE515B3251D7B9A9448B64

Function 00368F50 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

ApplyControlToken.SECUR32(?,?), ref: 00368FB5
InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00368FF9
DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 00369025
FreeCredentialsHandle.SECUR32(?), ref: 0036902F

Part of subcall function 00368760: FreeContextBuffer.SECUR32(?), ref: 00368774

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Context$FreeSecurity$ApplyBufferControlCredentialsDeleteHandleInitializeToken
String ID:
API String ID: 362823901-0
Opcode ID: 2ebc5b50b501c0180b1875c673685d0df52d8f7e7bf2e359bf60a4482bd331c6
Instruction ID: 9ed278ad4ab893974de07bd37f210538e0c120ce99783a7c0ac72dc68fc1d1ba
Opcode Fuzzy Hash: 2ebc5b50b501c0180b1875c673685d0df52d8f7e7bf2e359bf60a4482bd331c6
Instruction Fuzzy Hash: 2C41E8B1C00609ABCB11DF9AC885AEFFBFCFF98304F10850EE515A7615D7B5A6448BA4

Function 00404900 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C
ReleaseMutex.KERNEL32(-0000FFFF,?,00407495), ref: 004049A5
ReleaseMutex.KERNEL32(00407495,?,00407495), ref: 004049D1

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 63b75c3b539f6d5a62ae21cdc0f351efb8da632d2bdbb001c1f598c76031e3ef
Instruction ID: 60a01da9d8e12490b98d0435c3672651bd769e7b273c693051a5ec76faa180d4
Opcode Fuzzy Hash: 63b75c3b539f6d5a62ae21cdc0f351efb8da632d2bdbb001c1f598c76031e3ef
Instruction Fuzzy Hash: 5A2151F12012068BDB209F75E844BA777A9EFC4364B19457BEB88D7290D738DC51CB94

Function 004049F0 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,004073CC,00437C98,00000000,00000000,00000010,00000000), ref: 00404A10
ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00404A77
ReleaseMutex.KERNEL32(?,?,?,00000000), ref: 00404AA9
ReleaseMutex.KERNEL32(?,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 63d3ffe026840b187cbe0a3bca9a3e1a2581093c4aa0e4f7d61f639895044d6a
Instruction ID: 9de7bc225a4f11a468762aa64ff5b90ab43fa89967ea14f2f024b3cc108ef4f2
Opcode Fuzzy Hash: 63d3ffe026840b187cbe0a3bca9a3e1a2581093c4aa0e4f7d61f639895044d6a
Instruction Fuzzy Hash: 1A2182B23041055BDB10DE69EC80AAB73A9AFC0754715453BFE48A7390E738ED418AAC

Function 00364900 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00367495,000000FF,?,00000000,756F59EB,?,00367495), ref: 00364939
ReleaseMutex.KERNEL32(?,?,00367495), ref: 0036497C
ReleaseMutex.KERNEL32(-0000FFFF,?,00367495), ref: 003649A5
ReleaseMutex.KERNEL32(00367495,?,00367495), ref: 003649D1

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: a8a89f764e2dbbdcf2b55b5a43e79f50761cddd439196c77f1593fd035183e25
Instruction ID: f2eabd33349a1f8064d77dc747188ab3b564af08a83140195bbd3b6a3c4762bb
Opcode Fuzzy Hash: a8a89f764e2dbbdcf2b55b5a43e79f50761cddd439196c77f1593fd035183e25
Instruction Fuzzy Hash: C021B732A40206CFDB229F69E8457A773EDFF41364F1A8526E588C7248EB31DC51C790

Function 003649F0 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,003673CC,00397C98,00000000,00000000,00000010,00000000), ref: 00364A10
ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00364A77
ReleaseMutex.KERNEL32(?,?,?,00000000), ref: 00364AA9
ReleaseMutex.KERNEL32(?,00000000), ref: 00364ABC

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 0b030351a1a372c4b29af558933cbc94818ddea5d6cac9a0aca502d10c18ebd7
Instruction ID: bfdfd9af8d3bb25493b364b254ad337d51e6a32dbb6a93411bb8b5020b51b588
Opcode Fuzzy Hash: 0b030351a1a372c4b29af558933cbc94818ddea5d6cac9a0aca502d10c18ebd7
Instruction Fuzzy Hash: 82210B72B04104ABDB12DFA9EC806AA73ADEF81754B15C12AFC48CB344EB30DD4187D4

Function 004011C0 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004011E1
GetFileAttributesA.KERNEL32(?), ref: 00401201
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00401241
ExitThread.KERNEL32 ref: 00401261

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: AttributesByteCharExitFileMultiThreadWidememset
String ID:
API String ID: 1389112251-0
Opcode ID: e7413f48adbe43255a1fc25b920de3f2242b57c17ef6b082db6c1c638d69bb54
Instruction ID: 9c09465909980defebf6fc1bf24d1c266cb80464f9af9b5b5def457f6c2ce4cf
Opcode Fuzzy Hash: e7413f48adbe43255a1fc25b920de3f2242b57c17ef6b082db6c1c638d69bb54
Instruction Fuzzy Hash: A0215E76200208BBDB10DF55EC49FEB7778EB89711F004269FE19A3291DB34AD51CBA9

Function 003611C0 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003611E1
GetFileAttributesA.KERNEL32(?), ref: 00361201
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 00361241
ExitThread.KERNEL32 ref: 00361261

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: AttributesByteCharExitFileMultiThreadWidememset
String ID:
API String ID: 1389112251-0
Opcode ID: fb4741ae20c2f6256a78d77b0f7e2f904540e4c12fd95859a6489aea7cd0f836
Instruction ID: 7e3d9fe416b71ef9f6e86ad108e427176332970e98d469a90866ae52860cee51
Opcode Fuzzy Hash: fb4741ae20c2f6256a78d77b0f7e2f904540e4c12fd95859a6489aea7cd0f836
Instruction Fuzzy Hash: CF214976600208ABDB21DF58EC49FEB377CEB89711F048219FE1997281DA30A951CBA1

Function 0040D6B0 Relevance: 6.1, APIs: 4, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 0040D6FD
RegSetValueExW.ADVAPI32 ref: 0040D731
RegCloseKey.ADVAPI32(?), ref: 0040D740
RegCloseKey.ADVAPI32(?), ref: 0040D753

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: Close$CreateValue
String ID:
API String ID: 1009429713-0
Opcode ID: 023a06ccce26f21a6eb4b1cf29a7a46dec0311a4eb8ff73b697b9a0322046531
Instruction ID: 4ebeea118ffc0b70507ed0453d9bb896cfbcfcc1ebea939967c067b9dbd2b579
Opcode Fuzzy Hash: 023a06ccce26f21a6eb4b1cf29a7a46dec0311a4eb8ff73b697b9a0322046531
Instruction Fuzzy Hash: 80216075B40209BBDB14CF94DC46FAB7778EB88B44F108154FA05AB2D4E6B4FA049BA4

Function 0036D6B0 Relevance: 6.1, APIs: 4, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 0036D6FD
RegSetValueExW.ADVAPI32 ref: 0036D731
RegCloseKey.ADVAPI32(?), ref: 0036D740
RegCloseKey.ADVAPI32(?), ref: 0036D753

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Close$CreateValue
String ID:
API String ID: 1009429713-0
Opcode ID: 95c5dbd3d92bb1850e7a90f7c2a034308502273076e0f28e310bcf74bca53e93
Instruction ID: 843a82d1db2b9105b45bfeb4396ab9fd7e484dde1a8d96a49add43420b27f062
Opcode Fuzzy Hash: 95c5dbd3d92bb1850e7a90f7c2a034308502273076e0f28e310bcf74bca53e93
Instruction Fuzzy Hash: 26214275740209BBDB25CF98DC46FBA737CEB88B44F108144FA09AB284E670FA40D7A0

Function 00407EF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00407F06
LocalFree.KERNEL32(?,?), ref: 00407F19
LocalFree.KERNEL32(?,?), ref: 00407F3B

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: FreeLocal$closesocket
String ID:
API String ID: 1824021853-0
Opcode ID: 0d7af23abec9eedd371e7df087b943542a0927854f9a33720e7b197f5bd49994
Instruction ID: 58c757484c17e8af9c5a96bfa26f79bf23742db81f14522f08cab0e5839f8174
Opcode Fuzzy Hash: 0d7af23abec9eedd371e7df087b943542a0927854f9a33720e7b197f5bd49994
Instruction Fuzzy Hash: 46015E32B042109FC721DF59E88499A73A9FF8976531404BAF648DB350C635EC41CBA4

Function 00367EF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00367F06
LocalFree.KERNEL32(?,?), ref: 00367F19
LocalFree.KERNEL32(?,?), ref: 00367F3B

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: FreeLocal$closesocket
String ID:
API String ID: 1824021853-0
Opcode ID: ed64155edab9cc5f89a01ce21938d326648141ccbbf90e4e61e8a07cfd8fb8fe
Instruction ID: 4d08ffde4f98b3df19c2e72958bb7b5d119660bf228ae2dd0a422a98c21768da
Opcode Fuzzy Hash: ed64155edab9cc5f89a01ce21938d326648141ccbbf90e4e61e8a07cfd8fb8fe
Instruction Fuzzy Hash: 95011A367052149FC722DE69E884C9AB3A9FF8976535544AAF548CF319C631EC41CBA0

Function 0040A800 Relevance: 6.0, APIs: 4, Instructions: 49stringsleepCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0040A80A
GetTickCount.KERNEL32 ref: 0040A820
Sleep.KERNEL32 ref: 0040A859
strchr.MSVCRT ref: 0040A865

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: strchr$CountSleepTick
String ID:
API String ID: 735077530-0
Opcode ID: 5b989edbec9fb57e2c91f01ace7b0e21f16f3518f0f45a2d65738c978c86f70f
Instruction ID: 12bd840c873a94c867595e1b095c0c34b8311daa37525659d88b801d5309ee5b
Opcode Fuzzy Hash: 5b989edbec9fb57e2c91f01ace7b0e21f16f3518f0f45a2d65738c978c86f70f
Instruction Fuzzy Hash: D9F0497720030067D310B666DC87ECA739ECBC8366F00843AFA0997381E9BDDD4242BA

Function 0036A800 Relevance: 6.0, APIs: 4, Instructions: 49stringsleepCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0036A80A
GetTickCount.KERNEL32 ref: 0036A820
Sleep.KERNEL32 ref: 0036A859
strchr.MSVCRT ref: 0036A865

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: strchr$CountSleepTick
String ID:
API String ID: 735077530-0
Opcode ID: 1f86faceedf30533f19246ff7ce9a17c7cc809abcec4e85aec530aabacea605c
Instruction ID: f9200f9a9193a792e8eab8451fcfee1917c0776fedc8997ef9778f4fc91278e2
Opcode Fuzzy Hash: 1f86faceedf30533f19246ff7ce9a17c7cc809abcec4e85aec530aabacea605c
Instruction Fuzzy Hash: 48F0F4B72003049BD722A2A49C8AA9A775ADBC4761F048428FA0D8B205E97ADE4546B6

Function 0040A790 Relevance: 6.0, APIs: 4, Instructions: 44stringsleepCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0040A79B
GetTickCount.KERNEL32 ref: 0040A7B0
Sleep.KERNEL32 ref: 0040A7DC
strchr.MSVCRT ref: 0040A7E5

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: strchr$CountSleepTick
String ID:
API String ID: 735077530-0
Opcode ID: a56deda88b7bfe3fcc912b37b26a7d9c041b97cb9979405d9c52ec78308d40e7
Instruction ID: 7d5eb4f3d2123dae37af85631522b7622fe4fdd3bec7fbc1b2475d13fce141a8
Opcode Fuzzy Hash: a56deda88b7bfe3fcc912b37b26a7d9c041b97cb9979405d9c52ec78308d40e7
Instruction Fuzzy Hash: 2DF0467340021167C230A666EC82ACBF79CDB88762F048576FE04AB352E47CDE8581FA

Function 0036A790 Relevance: 6.0, APIs: 4, Instructions: 44stringsleepCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0036A79B
GetTickCount.KERNEL32 ref: 0036A7B0
Sleep.KERNEL32 ref: 0036A7DC
strchr.MSVCRT ref: 0036A7E5

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: strchr$CountSleepTick
String ID:
API String ID: 735077530-0
Opcode ID: 27626f0b7e9faf6066d974cdae0b849791ac0ef2a5f45c61da8dae5afadfc686
Instruction ID: 82c6938b2294a733663e56ae344826dbd11ef67120489d4f240b8e8310374c37
Opcode Fuzzy Hash: 27626f0b7e9faf6066d974cdae0b849791ac0ef2a5f45c61da8dae5afadfc686
Instruction Fuzzy Hash: 4DF02BB350111167C23266A9EC86A8BB79CDB80761F058575FE09AF202E56C9E4485F2

Function 0040A080 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040A0A2
WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0040A0C0
CloseHandle.KERNEL32(00000000), ref: 0040A0CB
CloseHandle.KERNEL32(00000000), ref: 0040A0D8

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CloseFileHandle$CreateWrite
String ID:
API String ID: 3602564925-0
Opcode ID: 468fddb27519cf46e4d5856843bc9a79975d9738623fcc55b54f1ea553afb210
Instruction ID: fe0a8d23ea9a6e4fc406740f8b7308c2032c4cdff1c410b5fcd8361f48a0f6c0
Opcode Fuzzy Hash: 468fddb27519cf46e4d5856843bc9a79975d9738623fcc55b54f1ea553afb210
Instruction Fuzzy Hash: FAF0C271240208BBE3209F98EC09FDB77A8EB4D720F008264FF09E72D0D6B06C0087A9

Function 0036A080 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0036A0A2
WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0036A0C0
CloseHandle.KERNEL32(00000000), ref: 0036A0CB
CloseHandle.KERNEL32(00000000), ref: 0036A0D8

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CloseFileHandle$CreateWrite
String ID:
API String ID: 3602564925-0
Opcode ID: 2180a4de2e3e1478059c40d10c2abd9015b08a486b10120ab9403fdfe39ec506
Instruction ID: c90f325fee7a3014e6974ad6d957c777c781512bb19dd41f40f7bb3c7e37b98f
Opcode Fuzzy Hash: 2180a4de2e3e1478059c40d10c2abd9015b08a486b10120ab9403fdfe39ec506
Instruction Fuzzy Hash: FEF06272251214BBE7209B9CEC09F9A37ACEB49764F504254FE08EB3C0EA716D4487A5

Function 00410880 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C

lstrlenA.KERNEL32(00000000,00000000,%s.p10-> Message to %s hijacked!,msn), ref: 004108B1

Part of subcall function 00407330: memset.MSVCRT ref: 00407351
Part of subcall function 00407330: lstrlenA.KERNEL32(?), ref: 00407369
Part of subcall function 00407330: _snprintf.MSVCRT ref: 00407381
Part of subcall function 00407330: _vsnprintf.MSVCRT ref: 004073A3
Part of subcall function 00407330: lstrlenA.KERNEL32(00000000), ref: 004073B2

Strings

%s_0x%08X, xrefs: 004108C0
msnmsg, xrefs: 0041088C
bmsn, xrefs: 004108C5

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$MutexObjectReleaseSingleWait_snprintf_vsnprintfmemset
String ID: %s_0x%08X$bmsn$msnmsg
API String ID: 1310428588-4225137719
Opcode ID: a24c34962bf9afaa6b58a18db10be76bedf8668f5e161a17a09eb47ecdbfd054
Instruction ID: 55a3b949f430f830e01e55d8eab2ca20a34dc41e3933f8760a51994ad7eb43cc
Opcode Fuzzy Hash: a24c34962bf9afaa6b58a18db10be76bedf8668f5e161a17a09eb47ecdbfd054
Instruction Fuzzy Hash: 86F08972B451183AE6206699AC02FEF764CC741765F540167FD08F6241D9A9595043E9

Function 00370880 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00364900: WaitForSingleObject.KERNEL32(00367495,000000FF,?,00000000,756F59EB,?,00367495), ref: 00364939
Part of subcall function 00364900: ReleaseMutex.KERNEL32(?,?,00367495), ref: 0036497C

lstrlenA.KERNEL32(00000000,00000000,%s.p10-> Message to %s hijacked!,msn), ref: 003708B1

Part of subcall function 00367330: memset.MSVCRT ref: 00367351
Part of subcall function 00367330: lstrlenA.KERNEL32(?), ref: 00367369
Part of subcall function 00367330: _snprintf.MSVCRT ref: 00367381
Part of subcall function 00367330: _vsnprintf.MSVCRT ref: 003673A3
Part of subcall function 00367330: lstrlenA.KERNEL32(00000000), ref: 003673B2

Strings

msnmsg, xrefs: 0037088C
%s_0x%08X, xrefs: 003708C0
bmsn, xrefs: 003708C5

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$MutexObjectReleaseSingleWait_snprintf_vsnprintfmemset
String ID: %s_0x%08X$bmsn$msnmsg
API String ID: 1310428588-4225137719
Opcode ID: c8e364cad72a1cfe65662bed58bd2009942f12596e6331dc7f01f3368bdcab04
Instruction ID: d058a667b0126e203e8ecd1657d365872daaed33363ec6df375fc2d27d5833d5
Opcode Fuzzy Hash: c8e364cad72a1cfe65662bed58bd2009942f12596e6331dc7f01f3368bdcab04
Instruction Fuzzy Hash: 9EF0E237B611287AE6326589AC02EFB768CCB42721F4441A1FD0CFA241E99A4E1012E1

Function 00410820 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00404900: WaitForSingleObject.KERNEL32(00407495,000000FF,?,00000000,756F59EB,?,00407495), ref: 00404939
Part of subcall function 00404900: ReleaseMutex.KERNEL32(?,?,00407495), ref: 0040497C

lstrlenA.KERNEL32(00000000,?,?,00402696), ref: 0041084B

Part of subcall function 004073E0: memset.MSVCRT ref: 00407401
Part of subcall function 004073E0: memset.MSVCRT ref: 00407419
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 00407431
Part of subcall function 004073E0: _snprintf.MSVCRT ref: 00407449
Part of subcall function 004073E0: _vsnprintf.MSVCRT ref: 0040746B
Part of subcall function 004073E0: lstrlenA.KERNEL32(?), ref: 0040747A

Strings

%s_0x%08X, xrefs: 0041085A
msnmsg, xrefs: 0041082B
bmsn, xrefs: 0041085F

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: lstrlen$memset$MutexObjectReleaseSingleWait_snprintf_vsnprintf
String ID: %s_0x%08X$bmsn$msnmsg
API String ID: 3682388603-4225137719
Opcode ID: cd2e5ab03e999fd462f644ac95d6ffc23b58fba4058bfc23253456729c482e8e
Instruction ID: b1f1ffa5900155dcc42b295b321ae9a5a6157eb97c0d41748f96ae968a92bafe
Opcode Fuzzy Hash: cd2e5ab03e999fd462f644ac95d6ffc23b58fba4058bfc23253456729c482e8e
Instruction Fuzzy Hash: F1F0A772A9512C3AE6207AA5AC02FFB724CCB06755F5001A7FD08F62C1E9E96A5002ED

Function 00370820 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00364900: WaitForSingleObject.KERNEL32(00367495,000000FF,?,00000000,756F59EB,?,00367495), ref: 00364939
Part of subcall function 00364900: ReleaseMutex.KERNEL32(?,?,00367495), ref: 0036497C

lstrlenA.KERNEL32(00000000,?,?,00362696), ref: 0037084B

Part of subcall function 003673E0: memset.MSVCRT ref: 00367401
Part of subcall function 003673E0: memset.MSVCRT ref: 00367419
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 00367431
Part of subcall function 003673E0: _snprintf.MSVCRT ref: 00367449
Part of subcall function 003673E0: _vsnprintf.MSVCRT ref: 0036746B
Part of subcall function 003673E0: lstrlenA.KERNEL32(?), ref: 0036747A

Strings

msnmsg, xrefs: 0037082B
%s_0x%08X, xrefs: 0037085A
bmsn, xrefs: 0037085F

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: lstrlen$memset$MutexObjectReleaseSingleWait_snprintf_vsnprintf
String ID: %s_0x%08X$bmsn$msnmsg
API String ID: 3682388603-4225137719
Opcode ID: 50c8dc742868bd36b3df418fc2a645ad2718d370ec1162129301706c1fbc220b
Instruction ID: 9be6777c1940360c2d067c2859ede6e25b04832183259e982b0e1bda88799d83
Opcode Fuzzy Hash: 50c8dc742868bd36b3df418fc2a645ad2718d370ec1162129301706c1fbc220b
Instruction Fuzzy Hash: 8FF0EC72EB51287AE63276A86C03FFB728CCB02750F448191FC0CFA285E9D95E1012E1

Function 0040B990 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B9AF
EnterCriticalSection.KERNEL32(0044A6C8,?,?,00000000), ref: 0040B9BC
wvsprintfA.USER32(00000000,?,00000000), ref: 0040B9D1

Part of subcall function 00408B30: memset.MSVCRT ref: 00408B6E

LeaveCriticalSection.KERNEL32(0044A6C8,?,?,?,?,?,00000000), ref: 0040B9F2

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavewvsprintf
String ID:
API String ID: 2410102678-0
Opcode ID: adfb22f81eb13afe8c56991aec3e6c19a43ebdbc02006d3e3b819ebf562d807f
Instruction ID: ab1e4383a872c048331199a66424550a9576d0d37af5aa461a589b4671dfd121
Opcode Fuzzy Hash: adfb22f81eb13afe8c56991aec3e6c19a43ebdbc02006d3e3b819ebf562d807f
Instruction Fuzzy Hash: 01F0F6B59402086BD710AB54DC0AFEA772CAF08708F0481AAFF0CA2240E6746A058BA9

Function 0036B990 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036B9AF
EnterCriticalSection.KERNEL32(003AA6C8,?,?,00000000), ref: 0036B9BC
wvsprintfA.USER32(00000000,?,00000000), ref: 0036B9D1

Part of subcall function 00368B30: memset.MSVCRT ref: 00368B6E

LeaveCriticalSection.KERNEL32(003AA6C8,?,?,?,?,?,00000000), ref: 0036B9F2

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavewvsprintf
String ID:
API String ID: 2410102678-0
Opcode ID: c4e45a872cf3132073c9e99723fef539652ef6c61bddbbf843dd478c454f2820
Instruction ID: 37c3add5eed76f87139f87282d033003d6633406f2f5a513f07f307390463773
Opcode Fuzzy Hash: c4e45a872cf3132073c9e99723fef539652ef6c61bddbbf843dd478c454f2820
Instruction Fuzzy Hash: 2DF0F6B69002086BC721AB64DC4AFFA372CEF04704F044194FF0DA6240E6706A458FA5

Function 0040E990 Relevance: 6.0, APIs: 4, Instructions: 31sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0000DD20,00000000,00000000,00000000), ref: 0040E9BF
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040E9C6
CloseHandle.KERNEL32(00000000), ref: 0040E9C9
Sleep.KERNEL32(0000EA60), ref: 0040E9D4

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CloseCreateHandleObjectSingleSleepThreadWait
String ID:
API String ID: 422747524-0
Opcode ID: 3520d3d245d61c6a96fe7d34961e73b05a6290d1859ec47a15f0ff463571a8f1
Instruction ID: 6016fdcd02b56c02497e5fa25d12d1976c48136526c7fd933aa435f2e59fedad
Opcode Fuzzy Hash: 3520d3d245d61c6a96fe7d34961e73b05a6290d1859ec47a15f0ff463571a8f1
Instruction Fuzzy Hash: 04F0E531641211BBE3205749AC46FDB7358EB49721F218432F300AA2F0C2B469808AAD

Function 0036E990 Relevance: 6.0, APIs: 4, Instructions: 31sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0000DD20,00000000,00000000,00000000), ref: 0036E9BF
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0036E9C6
CloseHandle.KERNEL32(00000000), ref: 0036E9C9
Sleep.KERNEL32(0000EA60), ref: 0036E9D4

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CloseCreateHandleObjectSingleSleepThreadWait
String ID:
API String ID: 422747524-0
Opcode ID: e19aaaf8b644e71bdc4bbab819c0185e6ac161888ef45ad5f894da7c32c838d6
Instruction ID: 58cde8b602cc0f36c31b699d5f84a15e2474dd6a37d6793f1bed44b2c1784177
Opcode Fuzzy Hash: e19aaaf8b644e71bdc4bbab819c0185e6ac161888ef45ad5f894da7c32c838d6
Instruction Fuzzy Hash: 01F0E532340200BBE332574D9C47F9A73ACEF46721F204012F308AA2E093B429C086AA

Function 0040BA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BA1E
wvsprintfA.USER32(00000000,00000000,00000000), ref: 0040BA42

Part of subcall function 0040B990: memset.MSVCRT ref: 0040B9AF
Part of subcall function 0040B990: EnterCriticalSection.KERNEL32(0044A6C8,?,?,00000000), ref: 0040B9BC
Part of subcall function 0040B990: wvsprintfA.USER32(00000000,?,00000000), ref: 0040B9D1
Part of subcall function 0040B990: LeaveCriticalSection.KERNEL32(0044A6C8,?,?,?,?,?,00000000), ref: 0040B9F2

Strings

PPPPMSG %s :%s, xrefs: 0040BA56

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: CriticalSectionmemsetwvsprintf$EnterLeave
String ID: PPPPMSG %s :%s
API String ID: 3980427996-569775469
Opcode ID: 703263f5a74a90de65f63654b87d016561f28cc2c25a020cc27163b67a065904
Instruction ID: 5b1b2f56d9f05309dbd408ca821aabdc91fdf399698cc66cc28d17444b118fdb
Opcode Fuzzy Hash: 703263f5a74a90de65f63654b87d016561f28cc2c25a020cc27163b67a065904
Instruction Fuzzy Hash: 6AF096B5900209ABDB10EB54DC45FE67378FB44704F0081AAB90857281FB74AA488FD9

Function 0036BA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0036BA1E
wvsprintfA.USER32(00000000,00000000,00000000), ref: 0036BA42

Part of subcall function 0036B990: memset.MSVCRT ref: 0036B9AF
Part of subcall function 0036B990: EnterCriticalSection.KERNEL32(003AA6C8,?,?,00000000), ref: 0036B9BC
Part of subcall function 0036B990: wvsprintfA.USER32(00000000,?,00000000), ref: 0036B9D1
Part of subcall function 0036B990: LeaveCriticalSection.KERNEL32(003AA6C8,?,?,?,?,?,00000000), ref: 0036B9F2

Strings

PPPPMSG %s :%s, xrefs: 0036BA56

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: CriticalSectionmemsetwvsprintf$EnterLeave
String ID: PPPPMSG %s :%s
API String ID: 3980427996-569775469
Opcode ID: 576a1b6b1eb05e07d1258a3968d4cd3cdc05e6628b22d3f853ea39cd537623b4
Instruction ID: ef96653c0a5acf0bd10ec38d7d4173b7e757c294ddd5352cf5c728dd8f421e26
Opcode Fuzzy Hash: 576a1b6b1eb05e07d1258a3968d4cd3cdc05e6628b22d3f853ea39cd537623b4
Instruction Fuzzy Hash: F7F096B5D00109ABDB25EB54DC45FA6737CFB44700F0481A5F90C97141FB74AA58CFA1

Function 00409300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(n"@), ref: 00409308
gethostbyname.WS2_32(n"@), ref: 00409313

Strings

n"@, xrefs: 00409304, 00409307, 00409312

Memory Dump Source

Source File: 00000004.00000002.399327116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_25F.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID: n"@
API String ID: 1594361348-1818638472
Opcode ID: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
Instruction ID: ae33d40cb3c9f804d6ae86217e78cba11e3a34fd54cb6a107b73e1e2973193cc
Opcode Fuzzy Hash: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
Instruction Fuzzy Hash: 7DD05B316006145BC910A66AE4418DA739CDE4E3787044157FE1CD77E3C775AC8046D9

Function 00369300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(n"6), ref: 00369308
gethostbyname.WS2_32(n"6), ref: 00369313

Strings

n"6, xrefs: 00369304, 00369307, 00369312

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID: n"6
API String ID: 1594361348-3573607553
Opcode ID: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
Instruction ID: e8c26bcdf85450cc084ac2633105e1a7ec7037625707314cc3f2bf934bc786bf
Opcode Fuzzy Hash: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
Instruction Fuzzy Hash: 74D05B356009149B4911A669E4409D9739CDE4A3747158157FA1CCF7A2C735AC4056D5

Function 003668B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,003A9E78,00000026,00000001), ref: 003668BB
PathAppendW.SHLWAPI(003A9E78,Internet Explorer\iexplore.exe), ref: 003668D0

Strings

Internet Explorer\iexplore.exe, xrefs: 003668C6

Memory Dump Source

Source File: 00000004.00000002.399293670.0000000000360000.00000040.00001000.00020000.00000000.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_360000_25F.jbxd

Similarity

API ID: Path$AppendFolderSpecial
String ID: Internet Explorer\iexplore.exe
API String ID: 2921508639-3330628412
Opcode ID: 3ea1eb32441de1f6822909183518b3694f0847cfda58279a30d710a2fcd06206
Instruction ID: e58eba9f132c0b64d11af64085038cf2e9ac7c35f62447fce830dc547dc89bac
Opcode Fuzzy Hash: 3ea1eb32441de1f6822909183518b3694f0847cfda58279a30d710a2fcd06206
Instruction Fuzzy Hash: B8C0122A3C038026EB335B284C8BFD13295E76BF82F808511F50AFD0D2C7D544805202

Analysis Process: QgGhoOpxHPl.exePID: 2384, Parent PID: 3380COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	203
Total number of Limit Nodes:	12

Executed Functions

Function 003D4C20 Relevance: 12.1, APIs: 8, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcessToken.ADVAPI32(00000000,00000028,?,003D4E7E,SeDebugPrivilege,00000001,00000000,ntdll.dll,NtGetNextProcess), ref: 003D4C32
GetLastError.KERNEL32 ref: 003D4C3C
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 003D4C52
GetLastError.KERNEL32 ref: 003D4C5C
CloseHandle.KERNEL32(?), ref: 003D4C66

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ErrorLast$CloseHandleLookupOpenPrivilegeProcessTokenValue
String ID:
API String ID: 1673749002-0
Opcode ID: 9eae95835072d7f88a973244ad74375d99e648a385a53da4b5d2c2604a7e9c3a
Instruction ID: 3b92875d432688f47ec62d7f8fad052c78aede0cf35a3a6f2f8b3886cd71c0a9
Opcode Fuzzy Hash: 9eae95835072d7f88a973244ad74375d99e648a385a53da4b5d2c2604a7e9c3a
Instruction Fuzzy Hash: 4C117375A10208ABDB21DBE4ED49FAEB7BCEB49701F404649FE09DB280DA719D048761

Function 003D4AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111
synchronizationstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT(EDB88F28,00010000,00000104,EDB88320,00000000,00000D10,?,00000000), ref: 003D4B1A
sprintf.MSVCRT(?,-%sMutex,00010000,EDB88F28,00010000,00000104,EDB88320,00000000,00000D10,?,00000000), ref: 003D4B2C
CreateMutexA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 003D4B3F
_snprintf.MSVCRT(?,00000104,%s_0,00010000,?,?,?,?,?,?,?,?,?,00000000), ref: 003D4B6F
OpenFileMappingA.KERNEL32(000F001F,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D4B85
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D4B97
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D4BE3
ReleaseMutex.KERNEL32(?,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D4C02

Strings

%s_0, xrefs: 003D4B5E
-%sMutex, xrefs: 003D4B26

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Mutex$CloseCreateFileHandleMappingObjectOpenReleaseSingleWait_snprintfsprintfstrncpy
String ID: %s_0$-%sMutex
API String ID: 4144850300-892854768
Opcode ID: 7a3f03325285fb515feacb0eba1ab88f250f10124d92d6b500174a37f108be26
Instruction ID: ccfb524271fa29ec5516bde7ed3b646fafc8fa890704194df9f7af6f11b4a965
Opcode Fuzzy Hash: 7a3f03325285fb515feacb0eba1ab88f250f10124d92d6b500174a37f108be26
Instruction Fuzzy Hash: 0D312CB26002446BD721DF65FC81FDA77AC9F54710F04465BFD899B280EBB1D9848690

Function 003D5A20 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 189
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00005070,00000000,00000000,00000000), ref: 003D5C03
CloseHandle.KERNEL32(00000000), ref: 003D5C0A
CreateThread.KERNEL32(00000000,00000000,Function_000050F0,00000000,00000000,00000000), ref: 003D5C3D
CloseHandle.KERNEL32(00000000), ref: 003D5C44

Strings

ntdll.dll, xrefs: 003D5B22, 003D5B40
NtResumeThread, xrefs: 003D5B1D
LdrLoadDll, xrefs: 003D5B3B

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID: LdrLoadDll$NtResumeThread$ntdll.dll
API String ID: 3032276028-1814628691
Opcode ID: 1904ec680757041d3d3c76c443b6ca2457345210af6d8384818ee27831ce4cae
Instruction ID: 0b689bcf191e0d56884bc566a038f67bac7e5eea288d365d2c188f22a5ac007a
Opcode Fuzzy Hash: 1904ec680757041d3d3c76c443b6ca2457345210af6d8384818ee27831ce4cae
Instruction Fuzzy Hash: 6861C276B40B12ABD722DF69EC81F6673A4BF44705F19462AE801EB781DB70F901CB94

Function 003D4D00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ntdll.dll, xrefs: 003D4E5D
NtGetNextProcess, xrefs: 003D4E58
SeDebugPrivilege, xrefs: 003D4E6F

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID:
String ID: NtGetNextProcess$SeDebugPrivilege$ntdll.dll
API String ID: 0-503679825
Opcode ID: 5656a5c900e727bf9bcc59d0f0a1b90ce46cfdc831844284d81a52fb9108cc60
Instruction ID: 5f4df8b93ff072242dd5400ff2ced71cedcee5725f03e941c7bddaabf10b764c
Opcode Fuzzy Hash: 5656a5c900e727bf9bcc59d0f0a1b90ce46cfdc831844284d81a52fb9108cc60
Instruction Fuzzy Hash: A331CAB6F4421476D611BB75BD07FAE32589B44700F004566F844BB3C2EAB96A40C7AB

Function 003D2F90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,00000000,00000010,?), ref: 003D2FD2
WriteProcessMemory.KERNEL32(?,00000000,?,00000020,?), ref: 003D301C
WriteProcessMemory.KERNEL32(?,?,?,00000000,00000020), ref: 003D3036
WriteProcessMemory.KERNEL32(?,00000000,00000000,00000004,00000020), ref: 003D3053

Strings

, xrefs: 003D3022

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: MemoryProcess$Write$Read
String ID:
API String ID: 2454571318-3916222277
Opcode ID: 69f1daaa7fd8d3f9ed07d2cbd1e46a4c6f3f7ca615fcb3ce0b166a4377613ab4
Instruction ID: e8e297a8ca37f5f6ceb3f8da02a6e275c7e161c783b05ca9a5a768d57a37ab86
Opcode Fuzzy Hash: 69f1daaa7fd8d3f9ed07d2cbd1e46a4c6f3f7ca615fcb3ce0b166a4377613ab4
Instruction Fuzzy Hash: 18314DB260050DABDB12DE99EC81EEFB37CEB40750F11416AE90696244E771AF46C7A2

Function 003D4470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.MSVCRT(?,00000104,%s_%d,EDB88F28,00000000), ref: 003D44A7
OpenFileMappingA.KERNEL32(000F001F,00000000,?), ref: 003D44BD
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 003D44F0
CloseHandle.KERNEL32(?), ref: 003D451B

Strings

%s_%d, xrefs: 003D4496

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: File$CloseHandleMappingOpenView_snprintf
String ID: %s_%d
API String ID: 460513966-1933919280
Opcode ID: fd7ef295c2662f94c463f328986799a26032d8f619bdb34b82d36f73aa8f7f6c
Instruction ID: e69c4309028f2da4d8288bfaec0a1655f1dfdbe9abbcd7a8493218098efb5d20
Opcode Fuzzy Hash: fd7ef295c2662f94c463f328986799a26032d8f619bdb34b82d36f73aa8f7f6c
Instruction Fuzzy Hash: FF21A4B26507068BD332CF18ED89B72B3E9EB84304F44867DE7469B285D779B860DB40

Non-executed Functions

Function 003DB480 Relevance: 66.9, APIs: 28, Strings: 10, Instructions: 363memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FF), ref: 003DB4A2

Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF), ref: 003D7401
Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 003D7419
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D7431
Part of subcall function 003D73E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 003D7449
Part of subcall function 003D73E0: _vsnprintf.MSVCRT(?,000001FE,003E0A8E,?), ref: 003D746B
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D747A

lstrcpyA.KERNEL32(?,003E1335), ref: 003DB51A
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 003DB536
GetVersionExA.KERNEL32(?), ref: 003DB550
lstrcpyA.KERNEL32(?,ERR), ref: 003DB5F5
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 003DB60D
strstr.MSVCRT(?, ), ref: 003DB641
lstrlenA.KERNEL32(00000000), ref: 003DB650
lstrlenA.KERNEL32(-00000004), ref: 003DB65F
GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 003DB67D
lstrcmpA.KERNEL32(-00000004,003E2BE4), ref: 003DB6A8
GetLocaleInfoA.KERNEL32(00000800,00000007,00000000,00000400), ref: 003DB6C5
lstrcpyA.KERNEL32(?,00000000), ref: 003DB719
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 003DB74A

Part of subcall function 003D1BA0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 003D1BC5

HeapAlloc.KERNEL32(?,00000008,00000104), ref: 003DB75B
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 003DB76E
HeapAlloc.KERNEL32(?,00000008,00000104), ref: 003DB781
_snprintf.MSVCRT(?,00000104,00000000), ref: 003DB796
_snprintf.MSVCRT(?,00000104,00000000,?,00000104,00000000), ref: 003DB7AB
lstrcpyA.KERNEL32(?,003E2C0C), ref: 003DB7CD
_snprintf.MSVCRT(00000000,00000104,n%s[%s{%s%s{%s,?,?,00000000,?,00000000), ref: 003DB7FC
_snprintf.MSVCRT(?,00000104,00000000,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000,00000000,00000104), ref: 003DB863
_snprintf.MSVCRT(?,00000104,00000000,?,00000104,00000000,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 003DB878
lstrcpyA.KERNEL32(?,003E2C0C), ref: 003DB89A
_snprintf.MSVCRT(00000000,00000104,n%s[%s{%s%s{%s,?,?,00000000,?,00000000), ref: 003DB8C9
_snprintf.MSVCRT(?,00000104,[%s{%s%s{%s,?,00000000,?,00000000), ref: 003DB8E0
??3@YAXPAX@Z.MSVCRT(?), ref: 003DB8F3

Strings

ERR, xrefs: 003DB5E4, 003DB5EC, 003DB68A, 003DB6CF, 003DB706
2K8, xrefs: 003DB5BD, 003DB5D9
http://api.wipmania.com/, xrefs: 003DB620
, xrefs: 003DB63B
2K3, xrefs: 003DB593
VIS, xrefs: 003DB5B2
[%s{%s%s{%s, xrefs: 003DB80B, 003DB8D5
admin, xrefs: 003DB4AE
n%s[%s{%s%s{%s, xrefs: 003DB7F1, 003DB8BE
isadmin, xrefs: 003DB4A9

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: _snprintf$AllocHeap$lstrcpy$lstrlen$memset$InfoLocaleTime$??3@FileSystemVersion_vsnprintflstrcmpstrstr
String ID: 2K3$2K8$ $ERR$VIS$[%s{%s%s{%s$admin$http://api.wipmania.com/$isadmin$n%s[%s{%s%s{%s
API String ID: 124843797-3058427118
Opcode ID: 395398f7bcff38c7f7ee863d7b3f5fa021373231e6cd83360dd22deedb4a618f
Instruction ID: 14a15a0e2c4f920124a0fc0911c29cf54afa3cad54ccce06d7969ec76ed553c6
Opcode Fuzzy Hash: 395398f7bcff38c7f7ee863d7b3f5fa021373231e6cd83360dd22deedb4a618f
Instruction Fuzzy Hash: D4C198B2A40345EBD725DF91EC82FABB37DAB44704F118A1DF246AB6C0D7B0E9448B51

Function 003D1EA0 Relevance: 37.7, APIs: 25, Instructions: 195fileencryptionCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 003D1ECD
GetLastError.KERNEL32 ref: 003D1EDA
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 003D1EF5
GetLastError.KERNEL32 ref: 003D1EFF
CloseHandle.KERNEL32(00000000), ref: 003D1F06

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ErrorLast$AcquireCloseContextCreateCryptFileHandle
String ID:
API String ID: 2213256293-0
Opcode ID: b9d2c786335b69fb0a04ca0e46b5e3383b8c973c7ea5fdb5fb44f0e47d8cf51f
Instruction ID: 90d09c70d6c6af339e9db207b626b86daf518441ff91a8ca3621780f238f7b8c
Opcode Fuzzy Hash: b9d2c786335b69fb0a04ca0e46b5e3383b8c973c7ea5fdb5fb44f0e47d8cf51f
Instruction Fuzzy Hash: FB519276600148BFDB229BE5ECC8ABFB77CFB48355F10469AFA05D6280D7319D458B60

Function 003DF130 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000105), ref: 003DF150
memset.MSVCRT(?,00000000,00000103,?,00000000,00000105), ref: 003DF168
lstrcpyA.KERNEL32(?,?), ref: 003DF17B

Part of subcall function 003DEDF0: memset.MSVCRT(?,00000000,00000103), ref: 003DEE0E
Part of subcall function 003DEDF0: vsprintf.MSVCRT(00000000,?,?,?,00000000,00000103), ref: 003DEE22
Part of subcall function 003DEDF0: PathAppendA.SHLWAPI(?,00000000), ref: 003DEE35

SetCurrentDirectoryA.KERNEL32(?), ref: 003DF196
FindFirstFileA.KERNEL32(?,?), ref: 003DF1AA
CoInitialize.OLE32(00000000), ref: 003DF1C2
_snprintf.MSVCRT(?,00000103,%s%s,?,?), ref: 003DF1E1
FindNextFileA.KERNEL32(?,?), ref: 003DF20C
strncmp.MSVCRT(?,RECYCLED,00000008), ref: 003DF22E
strstr.MSVCRT(?,.inf), ref: 003DF246
_snprintf.MSVCRT(?,00000103,%s%s,?,?), ref: 003DF26B
FindNextFileA.KERNEL32(?,?), ref: 003DF290
FindClose.KERNEL32(?), ref: 003DF29E

Strings

.inf, xrefs: 003DF240
RECYCLED, xrefs: 003DF228
%s%s, xrefs: 003DF1D0, 003DF25A

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Find$Filememset$Next_snprintf$AppendCloseCurrentDirectoryFirstInitializePathlstrcpystrncmpstrstrvsprintf
String ID: %s%s$.inf$RECYCLED
API String ID: 3870971729-188919753
Opcode ID: 59944833ff28043b30fc7dd9f2d3cb69439a9be525716ddeec1880949ed48905
Instruction ID: a149ec8d79435b09dffbb3d3a51e8a2a0640e6ade0f8d7b68919a9ffb109d5fa
Opcode Fuzzy Hash: 59944833ff28043b30fc7dd9f2d3cb69439a9be525716ddeec1880949ed48905
Instruction Fuzzy Hash: 1F41857694025CABCB25DB61EC85FEF777CEB54700F044699F509AA180E670AFC5CB60

Function 003D9D90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000004), ref: 003D9DA7
CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,20000080,00000000), ref: 003D9DD5

Strings

\\.\PHYSICALDRIVE0, xrefs: 003D9DD0

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: AllocCreateFileVirtual
String ID: \\.\PHYSICALDRIVE0
API String ID: 1475775534-1557481562
Opcode ID: 6f966fa33e44b5f2417194169455bdd23e333a98e819208564a47128597c7606
Instruction ID: 13305672d5774a4c58a5fe915b218f2c2147ba27911b6f7557eab5f545635497
Opcode Fuzzy Hash: 6f966fa33e44b5f2417194169455bdd23e333a98e819208564a47128597c7606
Instruction Fuzzy Hash: 6731A9727803447AF63196A9AC86FEB775CD784B32F200357FB04E92C0DAA06D4446F4

Function 003D9EC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF), ref: 003D9EDF
CreateFileA.KERNEL32(\\.\PHYSICALDRIVE0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 003D9F16
DeviceIoControl.KERNEL32(00000000,00090018,00000000,00000000,00000000,00000000,?,00000000), ref: 003D9F45
WriteFile.KERNEL32(00000000,00000000,00000200,?,00000000), ref: 003D9F5A
DeviceIoControl.KERNEL32(00000000,0009001C,00000000,00000000,00000000,00000000,?,00000000), ref: 003D9F74
CloseHandle.KERNEL32(00000000), ref: 003D9F77

Strings

00100, xrefs: 003D9EEC
U, xrefs: 003D9F0E
\\.\PHYSICALDRIVE0, xrefs: 003D9F09

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ControlDeviceFile$CloseCreateHandleWritememset
String ID: 00100$U$\\.\PHYSICALDRIVE0
API String ID: 3939175881-3482488017
Opcode ID: d6d54b7e6a2de3262dd776393442ed5d645d6f708fc54ebc2c9516e00fa4bd8b
Instruction ID: 218d318ec77fac386faf29d594df5c34164e275ea4907bffb39abe86a1dfcc62
Opcode Fuzzy Hash: d6d54b7e6a2de3262dd776393442ed5d645d6f708fc54ebc2c9516e00fa4bd8b
Instruction Fuzzy Hash: 6C11C432BD03587AF731E6A49C4BFDA776C8B55B11F100295F714BE1C19AF02B4087A9

Function 003DA550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,NtShutdownSystem), ref: 003DA57A
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 003DA58F
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 003DA5B3
GetLastError.KERNEL32 ref: 003DA5B9

Strings

ntdll.dll, xrefs: 003DA55C
NtShutdownSystem, xrefs: 003DA557
SeShutdownPrivilege, xrefs: 003DA588

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Token$AdjustErrorLastLookupOpenPrivilegePrivilegesProcessValue
String ID: NtShutdownSystem$SeShutdownPrivilege$ntdll.dll
API String ID: 137217592-1699316426
Opcode ID: 7b40da243514f1788fbe355eefdb7304f3e556978ee8eee6f20afb6959c6d006
Instruction ID: 73607b0d82aa17c7146041bd2361da0fa5101af808831b3eeaa0f54921d5f188
Opcode Fuzzy Hash: 7b40da243514f1788fbe355eefdb7304f3e556978ee8eee6f20afb6959c6d006
Instruction Fuzzy Hash: EDF04975A403547BD721EBE5AD4AFEF776C9B04701F500255F604E91C1DBB06E4487A2

Function 003D42E0 Relevance: 10.6, APIs: 7, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a4d7ca5b4fde14e6780c1c2c84dff7878e2e5d6c58e3e357a0f9246b13603c
Instruction ID: 1f0b4e5f9254636b1997e9f8193c5b414985657d637956b5f76bbe1a1aab72c1
Opcode Fuzzy Hash: 70a4d7ca5b4fde14e6780c1c2c84dff7878e2e5d6c58e3e357a0f9246b13603c
Instruction Fuzzy Hash: E23181B67002046BE7329B6EFC81F6BB3ADEB84711F15455AFD09DB380DA71EC1086A1

Function 003DD7A0 Relevance: 154.5, APIs: 54, Strings: 34, Instructions: 473
memorystringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,00000008,00000800), ref: 003DD7C3
HeapAlloc.KERNEL32(?,00000008,00000800), ref: 003DD7D2
memset.MSVCRT(?,00000000,00000103), ref: 003DD7EE
HeapFree.KERNEL32(?,?,00000000), ref: 003DD80B
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DD819
GetLastError.KERNEL32 ref: 003DD82F
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DD83C
GetLastError.KERNEL32 ref: 003DD852
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DD85B
ReadFile.KERNEL32(?,00000000,00000800,00000000,00000000), ref: 003DD87A
atoi.MSVCRT(00000000), ref: 003DD8D3
strchr.MSVCRT(00000000,0000002E), ref: 003DD8E8
lstrlenA.KERNEL32(30e44aa1), ref: 003DD900
HeapAlloc.KERNEL32(?,00000008,00000001), ref: 003DD924
HeapAlloc.KERNEL32(?,00000008,00000001), ref: 003DD930
strchr.MSVCRT(00000000,0000002E), ref: 003DD93F
lstrlenA.KERNEL32(00000000), ref: 003DD952
lstrcpynA.KERNEL32(00000000,00000001,00000000), ref: 003DD95E
lstrcpynA.KERNEL32(?,00000000,00000001), ref: 003DD96D
lstrcmpA.KERNEL32(?,ftplog), ref: 003DD97F

Strings

[Ruskill]: Detected Reg: "%s", xrefs: 003DDB8D
[HTTP Traffic]: %s, xrefs: 003DDA96
httpspread, xrefs: 003DDC46
[HTTP Login]: %s, xrefs: 003DDAC0
@W>, xrefs: 003DDC03, 003DDC52
30e44aa1, xrefs: 003DD8FA, 003DD908
<W>, xrefs: 003DD985, 003DD9F4
[FTP Infect]: %s was iframed, xrefs: 003DDA6B
[HTTP]: %s, xrefs: 003DDC59
[DNS]: Blocked DNS "%s", xrefs: 003DDBE2
httplogin, xrefs: 003DDAAE
ftpinfect, xrefs: 003DDA58
rreg, xrefs: 003DDB7A
0W>, xrefs: 003DDABA
block, xrefs: 003DDC37
[FTP Login]: %s, xrefs: 003DD98B
[Ruskill]: Detected File: "%s", xrefs: 003DDB38
[POP3 Login]: %s, xrefs: 003DD9FB
rdns, xrefs: 003DDB50
ruskill, xrefs: 003DDB0F
POP3 -> , xrefs: 003DDA2B
poplog, xrefs: 003DD9E8
ftplog, xrefs: 003DD979
[PDef+]: %s, xrefs: 003DDBB8
FTP -> , xrefs: 003DD9BB
blk, xrefs: 003DDC25
[MSN]: %s, xrefs: 003DDC0A
httptraff, xrefs: 003DDA83
[Ruskill]: Detected DNS: "%s", xrefs: 003DDB62
dns, xrefs: 003DDBD0
msn, xrefs: 003DDBF7
disable, xrefs: 003DDB1B
8W>, xrefs: 003DDB31, 003DDB5C, 003DDB86
4W>, xrefs: 003DDBB1

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heap$AllocFree$ErrorLastlstrcpynlstrlenstrchr$FileReadatoilstrcmpmemset
String ID: 0W>$30e44aa1$4W>$8W>$<W>$@W>$FTP -> $POP3 -> $[DNS]: Blocked DNS "%s"$[FTP Infect]: %s was iframed$[FTP Login]: %s$[HTTP Login]: %s$[HTTP Traffic]: %s$[HTTP]: %s$[MSN]: %s$[PDef+]: %s$[POP3 Login]: %s$[Ruskill]: Detected DNS: "%s"$[Ruskill]: Detected File: "%s"$[Ruskill]: Detected Reg: "%s"$blk$block$disable$dns$ftpinfect$ftplog$httplogin$httpspread$httptraff$msn$poplog$rdns$rreg$ruskill
API String ID: 1531277263-1463491000
Opcode ID: 5f53abe39b50baa8e0e1ee805948c55f117a3274bb869f86d829284142df5064
Instruction ID: 8fd7ece87feec81b6f62f21b64451cf7e3140fea68f673fed224e0f410836b78
Opcode Fuzzy Hash: 5f53abe39b50baa8e0e1ee805948c55f117a3274bb869f86d829284142df5064
Instruction Fuzzy Hash: CBE13476640694BBD7235BA5AC86FFF773CEF85744F11420AFA01AA3D1DBB09D0086A1

Function 003E0430 Relevance: 112.3, APIs: 51, Strings: 13, Instructions: 334
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,00000000,00000000,756F59EB), ref: 003E0446
GetProcessHeap.KERNEL32(00000008,00000001), ref: 003E044C
HeapAlloc.KERNEL32(00000000), ref: 003E0453
memset.MSVCRT(?,00000000,00000103), ref: 003E048B
GetProcessHeap.KERNEL32 ref: 003E0493
lstrcpyA.KERNEL32(00000000,?), ref: 003E04A9
sscanf.MSVCRT(00000000,SDG %d,?), ref: 003E04C5
strstr.MSVCRT(00000000,X-MMS-IM-Format: ), ref: 003E04DC
lstrlenA.KERNEL32(003D2780), ref: 003E04F0
lstrlenA.KERNEL32(?), ref: 003E04FA
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 003E0505
strtok.MSVCRT(00000000,003E2B84), ref: 003E051B
lstrcpyA.KERNEL32(00000000,003E1335), ref: 003E0534
_memicmp.MSVCRT(00000000,Content-Length: ,00000010), ref: 003E0557
lstrlenA.KERNEL32(003D2780), ref: 003E0567
_snprintf.MSVCRT(?,00000103,Content-Length: %d,00000000), ref: 003E057B
_memicmp.MSVCRT(00000000,From: ,00000006), ref: 003E0596
lstrcatA.KERNEL32(00000000,00000000), ref: 003E05A7
lstrcatA.KERNEL32(00000000,00000000), ref: 003E05F1
lstrcatA.KERNEL32(00000000,003E2B84), ref: 003E05F9
strtok.MSVCRT(00000000,003E2B84), ref: 003E0602
lstrcatA.KERNEL32(00000000,00000000), ref: 003E061C
lstrcatA.KERNEL32(00000000,), ref: 003E0624
lstrcatA.KERNEL32(00000000,003D2780), ref: 003E062B
lstrlenA.KERNEL32(00000000), ref: 003E062E
_snprintf.MSVCRT(?,00000103,SDG %d %d,?,00000000), ref: 003E0646
lstrlenA.KERNEL32(00000000), ref: 003E064F
lstrlenA.KERNEL32(?), ref: 003E065A
HeapAlloc.KERNEL32(?,00000008,00000040), ref: 003E0667
_snprintf.MSVCRT(00000000,0000003F,%s%s,?,00000000), ref: 003E0688
sscanf.MSVCRT(00000000,MSG %d %1s,?,?), ref: 003E06A0
strstr.MSVCRT(00000000,003E2B84), ref: 003E06B7
strstr.MSVCRT(-00000002,), ref: 003E06D2
lstrlenA.KERNEL32(00000000), ref: 003E06E6
lstrlenA.KERNEL32(-00000002), ref: 003E06F3
HeapAlloc.KERNEL32(?,00000008,?), ref: 003E06FF
lstrlenA.KERNEL32(00000000), ref: 003E0714
lstrlenA.KERNEL32(-00000002), ref: 003E0721
lstrcpynA.KERNEL32(?,-00000002,?), ref: 003E072C
lstrlenA.KERNEL32(?), ref: 003E0736
lstrlenA.KERNEL32(003D2780), ref: 003E073E
HeapAlloc.KERNEL32(?,00000008,?), ref: 003E074B
lstrlenA.KERNEL32(?,?,003D2780), ref: 003E0761
lstrlenA.KERNEL32(003D2780), ref: 003E076A
_snprintf.MSVCRT(?,?,MSG %d %s %d%s%s,?,?,00000004), ref: 003E0787
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E079F
HeapFree.KERNEL32(?,00000000,?), ref: 003E07AC
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E07B6

Strings

%s%s, xrefs: 003E0680
From: , xrefs: 003E0590
SDG %d, xrefs: 003E04BF
MSG %d %s %d%s%s, xrefs: 003E077F
X-MMS-IM-Format: , xrefs: 003E04D6, 003E05DA
SDG , xrefs: 003E0543
Content-Length: %d, xrefs: 003E056A
, xrefs: 003E05A9, 003E05CE, 003E061E, 003E06CC
Reliability: , xrefs: 003E05B5
SDG , xrefs: 003E04AF
MSG %d %1s, xrefs: 003E069A
SDG %d %d, xrefs: 003E0635
Content-Length: , xrefs: 003E0551

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$Heap$lstrcat$Alloc$_snprintf$Freestrstr$Process_memicmplstrcpysscanfstrtok$lstrcpynmemset
String ID: $%s%s$Content-Length: $Content-Length: %d$From: $MSG %d %1s$MSG %d %s %d%s%s$Reliability: $SDG $SDG $SDG %d$SDG %d %d$X-MMS-IM-Format:
API String ID: 375969099-2909086048
Opcode ID: 8e4aaa25985d45d3c9f33ae9983cd7aa8fc701ffcb7b115daf8045c5c1e477cb
Instruction ID: f75678f3bf4e7efd488b6e5a5bde3193d2a1c1f32a94ec1262152e95b8d4ec40
Opcode Fuzzy Hash: 8e4aaa25985d45d3c9f33ae9983cd7aa8fc701ffcb7b115daf8045c5c1e477cb
Instruction Fuzzy Hash: 54A141B5A00269BBDB16DBA68C85EFF777CEB48700F044655F904A72C1EAB4DE408B60

Function 003DF430 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 431
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003DF459
memset.MSVCRT(?,00000000,00000103), ref: 003DF472
memset.MSVCRT(?,00000000,00000103,?,00000000,00000103), ref: 003DF48B
memset.MSVCRT(?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 003DF4A4
memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 003DF4BD
memset.MSVCRT(?,00000000,00000103,?,00000000,000003FF,?,00000000,000003FF,?,00000000,00000103,?,00000000,00000103), ref: 003DF4D6
memset.MSVCRT ref: 003DF4F2
memset.MSVCRT(?,00000000,00000103), ref: 003DF50B
memset.MSVCRT(?,00000000,0000040E,?,00000000,00000103), ref: 003DF526
memset.MSVCRT(?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 003DF541
memset.MSVCRT(?,00000000,00000206,?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 003DF55C
sprintf.MSVCRT(?,%sautorun.inf,?,?,00000000,00000206,?,00000000,0000040E,?,00000000,0000040E,?,00000000,00000103), ref: 003DF571
sprintf.MSVCRT(?,%sautorun.tmp,?), ref: 003DF586
wsprintfW.USER32(?,003E3018,?,?,%sautorun.tmp,?), ref: 003DF5A4
sprintf.MSVCRT(?,%s\%s,0041BDB0,0041BEB4), ref: 003DF5BC
sprintf.MSVCRT(?,%s%s,?,0041BDB0,?,%s\%s,0041BDB0,0041BEB4), ref: 003DF5D3
sprintf.MSVCRT(?,%s%s,?,?,?,%s%s,?,0041BDB0,?,%s\%s,0041BDB0,0041BEB4), ref: 003DF5EC
wsprintfW.USER32(?,003E3018,?), ref: 003DF607
wsprintfW.USER32(?,%S%S\Desktop.ini,?,0041BDB0), ref: 003DF61B

Part of subcall function 003D1CF0: GetFileAttributesW.KERNEL32(?), ref: 003D1CF7

_stricmp.MSVCRT(00000000,ERR), ref: 003DF64B
_stricmp.MSVCRT(0041A920,00000000), ref: 003DF65D
SetFileAttributesA.KERNEL32(?,00000080), ref: 003DF684
SetFileAttributesA.KERNEL32(?,00000080), ref: 003DF692
SetFileAttributesA.KERNEL32(?,00000080), ref: 003DF6A0
CreateDirectoryA.KERNEL32(?,00000000), ref: 003DF6AA
GetLastError.KERNEL32 ref: 003DF6B4
CopyFileW.KERNEL32(0041B9A0,?,00000000), ref: 003DF6CE
lstrlenA.KERNEL32([.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E},00000000), ref: 003DF6DE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 003DF747
lstrcpyA.KERNEL32(?,00003E2F), ref: 003DF7DA
lstrcatA.KERNEL32(?,?), ref: 003DF7EE

Part of subcall function 003D1EA0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 003D1ECD
Part of subcall function 003D1EA0: GetLastError.KERNEL32 ref: 003D1EDA

lstrcatA.KERNEL32(?,003E2B84), ref: 003DF800
lstrlenA.KERNEL32(?,?,00000000), ref: 003DF813
lstrlenA.KERNEL32(00003E2F,?,00000000), ref: 003DF828
WriteFile.KERNEL32(00000000,00003E2F,00000000), ref: 003DF837
lstrlenA.KERNEL32(?,?,00000000), ref: 003DF87C
WriteFile.KERNEL32(00000000,?,00000000), ref: 003DF88B
CloseHandle.KERNEL32(00000000), ref: 003DF8B1
Sleep.KERNEL32(00000032), ref: 003DF8C4
SetFileAttributesA.KERNEL32(?,00000004), ref: 003DF901
SetFileAttributesA.KERNEL32(?,00000004), ref: 003DF93A
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 003DF97D
GetFileSize.KERNEL32(00000000,00000000), ref: 003DF984
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003DF98D
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 003DF9BE
GetFileSize.KERNEL32(00000000,00000000), ref: 003DF9C5
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003DF9CE

Strings

%s\%s, xrefs: 003DF5B6
ERR, xrefs: 003DF645
[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}, xrefs: 003DF6D9, 003DF6EB
%S%S\Desktop.ini, xrefs: 003DF615
%sautorun.tmp, xrefs: 003DF580
%sautorun.inf, xrefs: 003DF565
%s%s, xrefs: 003DF5CD, 003DF5E6
usbi, xrefs: 003DF6F6, 003DF993

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: File$memset$Attributes$Createsprintf$lstrlen$wsprintf$ErrorLastLockSizeWrite_stricmplstrcat$CloseCopyDirectoryHandleSleeplstrcpy
String ID: %S%S\Desktop.ini$%s%s$%s\%s$%sautorun.inf$%sautorun.tmp$ERR$[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}$usbi
API String ID: 2867265384-3663527224
Opcode ID: 58c423a86e168dfa74826abf25369916911a66ac0c722bfa77702ed0d3dc4301
Instruction ID: 0a5726852eabc200df7fdd4edabc418808c1cf3a77b0e7399d539f7de6605f01
Opcode Fuzzy Hash: 58c423a86e168dfa74826abf25369916911a66ac0c722bfa77702ed0d3dc4301
Instruction Fuzzy Hash: 17E1D872940268BAD732D760DCC5FEA777CEB58740F0046A6F609A61C1D7B0AB84CFA5

Function 003DE9F0 Relevance: 75.5, APIs: 31, Strings: 12, Instructions: 271stringfilethreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003DEA0F
LoadLibraryW.KERNEL32(ws2_32.dll), ref: 003DEA22
LoadLibraryW.KERNEL32(secur32.dll), ref: 003DEA29
LoadLibraryW.KERNEL32(wininet.dll), ref: 003DEA30
CreateMutexA.KERNEL32(00000000,00000000,003E57AC), ref: 003DEA3B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003DEA44

Part of subcall function 003D7330: memset.MSVCRT(?,00000000,000001FF), ref: 003D7351
Part of subcall function 003D7330: lstrlenA.KERNEL32(?), ref: 003D7369
Part of subcall function 003D7330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 003D7381
Part of subcall function 003D7330: _vsnprintf.MSVCRT(00000000,000001FE,003E0AAD,?), ref: 003D73A3
Part of subcall function 003D7330: lstrlenA.KERNEL32(00000000), ref: 003D73B2

CopyFileW.KERNEL32(0041AFB0,0041ADA0,00000000), ref: 003DEACF

Part of subcall function 003DD6B0: RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 003DD731
Part of subcall function 003DD6B0: RegCloseKey.ADVAPI32(?), ref: 003DD740

Sleep.KERNEL32(000003E8), ref: 003DEAFC

Part of subcall function 003D1AD0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 003D1AE9

DeleteFileW.KERNEL32(0041AFB0), ref: 003DEB2F
Sleep.KERNEL32(00003A98), ref: 003DEB3A
DeleteFileW.KERNEL32(0041AFB0), ref: 003DEB41
lstrcpyA.KERNEL32(0041A920,ERR), ref: 003DEB61
lstrlenA.KERNEL32(003E57C0), ref: 003DEB72
lstrlenA.KERNEL32(003E57C0), ref: 003DEBB5
_snprintf.MSVCRT(00000000,00000103,003E2B10,00000539), ref: 003DEBDE
lstrlenA.KERNEL32(00000000), ref: 003DEC15
InitializeCriticalSection.KERNEL32(0041B3C8), ref: 003DEC32
memset.MSVCRT(?,00000000,00000206,0041A6E0,00407A80,00000001), ref: 003DEC5F
wsprintfW.USER32(?,%s:Zone.Identifier,0041ADA0,?,00000000,00000206,0041A6E0,00407A80,00000001), ref: 003DEC75
DeleteFileW.KERNEL32(?), ref: 003DEC95
GetLastError.KERNEL32 ref: 003DEC97

Part of subcall function 003D1CF0: GetFileAttributesW.KERNEL32(?), ref: 003D1CF7

CreateThread.KERNEL32(00000000,00000000,Function_0000E880,00000000,00000000,00000000), ref: 003DECB2
CloseHandle.KERNEL32(00000000), ref: 003DECBB
CreateThread.KERNEL32(00000000,00000000,003DE990,00000000,00000000,00000000), ref: 003DECCC
CloseHandle.KERNEL32(00000000), ref: 003DECCF
lstrlenA.KERNEL32(0041B3E0), ref: 003DED26
lstrlenA.KERNEL32(0041AC50,?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000), ref: 003DED5E
CreateThread.KERNEL32(00000000,00000000,Function_0000E770,0041B990,00000000,00000000,?,0041AC50,00000000), ref: 003DED83
CloseHandle.KERNEL32(00000000), ref: 003DED86
CreateThread.KERNEL32(00000000,00000000,003DFC90,00000000,00000000,00000000), ref: 003DEDA1
CloseHandle.KERNEL32(00000000), ref: 003DEDA4

Strings

ws2_32.dll, xrefs: 003DEA1D
wininet.dll, xrefs: 003DEA2B
ERR, xrefs: 003DEB57
%s:Zone.Identifier, xrefs: 003DEC6F
ngrBot, xrefs: 003DEA84
msnmsg, xrefs: 003DEB88
running, xrefs: 003DEA7F
msnint, xrefs: 003DEBE9
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 003DEADF, 003DED3A
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 003DED4E
IPC_Check, xrefs: 003DEA64
secur32.dll, xrefs: 003DEA24

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$File$CloseCreate$HandleThread$DeleteLibraryLoadmemset$SleepTime_snprintf$AttributesCopyCriticalErrorInitializeLastMutexObjectSectionSingleSystemValueWait_vsnprintflstrcpywsprintf
String ID: %s:Zone.Identifier$ERR$IPC_Check$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$msnint$msnmsg$ngrBot$running$secur32.dll$wininet.dll$ws2_32.dll
API String ID: 4164503275-3436408089
Opcode ID: 0faceb84deae9a6da616910233e1e3cade944cec690d84d41e55496dcbcd1289
Instruction ID: 5d51e2f24f6ad0010dcb5d25a63d436741d9f98e9af8f0afaaed244d737e3d85
Opcode Fuzzy Hash: 0faceb84deae9a6da616910233e1e3cade944cec690d84d41e55496dcbcd1289
Instruction Fuzzy Hash: 8981D8B6B8136476E63277A1BC47FDB3A1C9B40F14F144113FA057E2C2DAF46A9085AE

Function 003DE130 Relevance: 59.8, APIs: 24, Strings: 10, Instructions: 255sleepstringfileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041B3C8), ref: 003DE14B

Part of subcall function 003D9FF0: strtok.MSVCRT(?,?,0000002C), ref: 003DA013
Part of subcall function 003D9FF0: strtok.MSVCRT(00000000,?), ref: 003DA04F

GetLastError.KERNEL32 ref: 003DE17E
GetLastError.KERNEL32 ref: 003DE18B
GetLastError.KERNEL32 ref: 003DE198
GetLastError.KERNEL32 ref: 003DE1A5
Sleep.KERNEL32(00003A98), ref: 003DE1C8
Sleep.KERNEL32(000003E8), ref: 003DE22B
lstrlenA.KERNEL32(00000000), ref: 003DE24D
_memicmp.MSVCRT(?,00000000,00000000), ref: 003DE259
MoveFileExW.KERNEL32(00000000,0041ADA0,0000000B), ref: 003DE292
MoveFileExW.KERNEL32(00000000,0041ADA0,00000004), ref: 003DE2A4
lstrcpyA.KERNEL32(0041A920,00000000), ref: 003DE2C0
lstrcmpA.KERNEL32(?,003E2C7C), ref: 003DE2D3
Sleep.KERNEL32(000007D0), ref: 003DE2FA
Sleep.KERNEL32(000007D0), ref: 003DE30A

Part of subcall function 003DBA00: memset.MSVCRT(?,00000000,000007FF), ref: 003DBA1E
Part of subcall function 003DBA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 003DBA42

DeleteFileW.KERNEL32(00000000), ref: 003DE43A
HeapFree.KERNEL32(?,00000000,?), ref: 003DE45D
??3@YAXPAX@Z.MSVCRT(?), ref: 003DE46B
LeaveCriticalSection.KERNEL32(0041B3C8), ref: 003DE478

Strings

bsod, xrefs: 003DE312
[d="%s"] Error downloading file [e="%d"], xrefs: 003DE405
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d, xrefs: 003DE41C
[d="%s"] Error getting temporary filename. [e="%d"], xrefs: 003DE3D1
rebooting, xrefs: 003DE2DE
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 003DE36E
QUIT :%s, xrefs: 003DE2E3
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s), xrefs: 003DE359
[d="%s"] Error writing download to "%S" [e="%d"], xrefs: 003DE383, 003DE3AE
[d='%s"] Error getting application data path [e="%d"], xrefs: 003DE3F4

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ErrorLastSleep$File$CriticalMoveSectionstrtok$??3@DeleteEnterFreeHeapLeave_memicmplstrcmplstrcpylstrlenmemsetwvsprintf
String ID: QUIT :%s$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$bsod$rebooting
API String ID: 4206007775-4213298338
Opcode ID: 0e9d9c51ff963f0392174dedffd301eadbf14d2fb655b5940513456a4b9f5e73
Instruction ID: 490be749f232fd2a6582744e297119379c2f44e78112a04a2e3d0c3ca944d5ef
Opcode Fuzzy Hash: 0e9d9c51ff963f0392174dedffd301eadbf14d2fb655b5940513456a4b9f5e73
Instruction Fuzzy Hash: 1F81D5B6A00254FBD723BBA5EC4AEBE7B7CEF44710F10461BF9119A3D1D77099409A22

Function 003DDDB0 Relevance: 56.3, APIs: 20, Strings: 12, Instructions: 281sleepstringmemoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041B3C8), ref: 003DDDCF

Part of subcall function 003D9FF0: strtok.MSVCRT(?,?,0000002C), ref: 003DA013
Part of subcall function 003D9FF0: strtok.MSVCRT(00000000,?), ref: 003DA04F

strstr.MSVCRT(00000000,http://), ref: 003DDDF4
lstrlenA.KERNEL32(?), ref: 003DDE11
toupper.MSVCRT(00000000), ref: 003DDE28
GetLastError.KERNEL32 ref: 003DDE68
GetLastError.KERNEL32 ref: 003DDE71
GetLastError.KERNEL32 ref: 003DDE7A
GetLastError.KERNEL32 ref: 003DDE83
Sleep.KERNEL32(00003A98), ref: 003DDEA8
Sleep.KERNEL32(000003E8), ref: 003DDF16
_stricmp.MSVCRT(?,00000000), ref: 003DDF3D
Sleep.KERNEL32(00000032), ref: 003DDF6A
GetLastError.KERNEL32([d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"],?,?,?,00000000), ref: 003DE021
GetLastError.KERNEL32 ref: 003DE059
GetLastError.KERNEL32([d="%s" s="%d bytes"] Error creating process "%S" [e="%d"],?,?,?,00000000), ref: 003DE037

Part of subcall function 003DBA00: memset.MSVCRT(?,00000000,000007FF), ref: 003DBA1E
Part of subcall function 003DBA00: wvsprintfA.USER32(00000000,00000000,00000000), ref: 003DBA42

HeapFree.KERNEL32(?,00000000,?), ref: 003DE0DD
??3@YAXPAX@Z.MSVCRT(?), ref: 003DE0EB
LeaveCriticalSection.KERNEL32(0041B3C8), ref: 003DE0F8

Strings

ERR, xrefs: 003DDFEC
[d="%s"] Error downloading file [e="%d"], xrefs: 003DE08E
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d, xrefs: 003DE0A5
[d="%s"] Error getting temporary filename. [e="%d"], xrefs: 003DE060
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"], xrefs: 003DE017
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s), xrefs: 003DDFFE
http://, xrefs: 003DDDEE
dlds, xrefs: 003DDE44, 003DDFA6
[d="%s"] Error writing download to "%S" [e="%d"], xrefs: 003DE042
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"], xrefs: 003DE030
[d='%s"] Error getting application data path [e="%d"], xrefs: 003DE080
exe, xrefs: 003DDEE4

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ErrorLast$Sleep$CriticalSectionstrtok$??3@EnterFreeHeapLeave_stricmplstrlenmemsetstrstrtoupperwvsprintf
String ID: ERR$[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)$[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]$[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d$[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]$[d="%s"] Error downloading file [e="%d"]$[d="%s"] Error getting temporary filename. [e="%d"]$[d="%s"] Error writing download to "%S" [e="%d"]$[d='%s"] Error getting application data path [e="%d"]$dlds$exe$http://
API String ID: 3190375853-4059846736
Opcode ID: df9f295c966f5122ae8880055d8a3ad4f4780dd40f285b2b4b70f16d04ad65de
Instruction ID: da9e554250a5beb64ee5585cb3669c64554f1c745a9bb4d3e95b0bb81093c846
Opcode Fuzzy Hash: df9f295c966f5122ae8880055d8a3ad4f4780dd40f285b2b4b70f16d04ad65de
Instruction Fuzzy Hash: 6291C2B6A00244ABD712DB95EC86ABFB7BDEB94700F11451AF9069B3C1D770EE40C761

Function 003D7870 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 249stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF,?,00000000,?), ref: 003D7898
lstrlenA.KERNEL32(-00000005,00000000,00000000,?,?,?,00000000,?), ref: 003D795D
_snprintf.MSVCRT(0041A2B0,000001FF,003E13EC,-00000005,?,?,00000000,?), ref: 003D797B
_snprintf.MSVCRT(0041A4B0,000001FF,003E13EC,-00000005,?,?,00000000,?), ref: 003D79B7
lstrlenA.KERNEL32(0041A2B0,?,00000000,?), ref: 003D7A5A
lstrlenA.KERNEL32(0041A4B0), ref: 003D7A69
_snprintf.MSVCRT(00000000,000001FF,ftp://%s:%s@%s:%d,0041A2B0,0041A4B0,00000000,00000000), ref: 003D7AD9
_stricmp.MSVCRT(0041A2B0,anonymous,00000000,000001FF,ftp://%s:%s@%s:%d,0041A2B0,0041A4B0,00000000,00000000), ref: 003D7AE8
_snprintf.MSVCRT(00000000,000001FF,pop3://%s:%s@%s:%d,0041A2B0,0041A4B0,00000000,00000000), ref: 003D7B66

Part of subcall function 003D2460: GetProcessHeap.KERNEL32(?,003D20DE,?), ref: 003D246C
Part of subcall function 003D2460: HeapAlloc.KERNEL32(?,00000008,003D20DE,?,003D20DE,?), ref: 003D247E

lstrcpyA.KERNEL32(0041A2B0,003E1335,?,00000000,?), ref: 003D7BBC
lstrcpyA.KERNEL32(0041A4B0,003E1335), ref: 003D7BC8

Strings

STAT, xrefs: 003D7A1B
ftpgrab, xrefs: 003D7AA6
%s:%s@%s:%d, xrefs: 003D7B04, 003D7B77
%s.%s (p='%S'), xrefs: 003D7B9F
poplog, xrefs: 003D7B9A
ftplog, xrefs: 003D7B2B
ftp://%s:%s@%s:%d, xrefs: 003D7AC8
FEAT, xrefs: 003D79FA
PASS, xrefs: 003D78F8
LIST, xrefs: 003D7A22
block, xrefs: 003D7B09, 003D7B7C
PASV, xrefs: 003D7A08
popgrab, xrefs: 003D7B37
pop3://%s:%s@%s:%d, xrefs: 003D7B55
TYPE, xrefs: 003D7A01
anonymous, xrefs: 003D7ADE
USER, xrefs: 003D78F1

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: _snprintf$lstrlen$Heaplstrcpy$AllocProcess_stricmpmemset
String ID: %s.%s (p='%S')$%s:%s@%s:%d$FEAT$LIST$PASS$PASV$STAT$TYPE$USER$anonymous$block$ftp://%s:%s@%s:%d$ftpgrab$ftplog$pop3://%s:%s@%s:%d$popgrab$poplog
API String ID: 389836911-2374598668
Opcode ID: 5e319ed7389ad80f4f248e69f141d307bf98331ca9d6ea2016708d24fe3428c1
Instruction ID: 93c4c2392e0f9db7cb17e8dfa444fb22cb4903c3c021d77488de138a61585c07
Opcode Fuzzy Hash: 5e319ed7389ad80f4f248e69f141d307bf98331ca9d6ea2016708d24fe3428c1
Instruction Fuzzy Hash: 5A818C33E093916ADB33AF64AC46FEE3A649B01710F194567F804A73C2F7B49994824B

Function 003E0910 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 172sleepstringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003E0930
GetProcessHeap.KERNEL32 ref: 003E093D
memset.MSVCRT(?,00000000,00000103), ref: 003E095D
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 003E0982
ShellExecuteA.SHELL32(00000000,OPEN,00000000,00000000,00000000,00000005,00000003), ref: 003E09BF

Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF), ref: 003D7401
Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 003D7419
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D7431
Part of subcall function 003D73E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 003D7449
Part of subcall function 003D73E0: _vsnprintf.MSVCRT(?,000001FE,003E0A8E,?), ref: 003D746B
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D747A

GetTickCount.KERNEL32 ref: 003E09CF
Sleep.KERNEL32 ref: 003E0A05
OpenMutexA.KERNEL32(001F0001,00000000,003E57AC), ref: 003E0A17
GetLastError.KERNEL32 ref: 003E0A27
GetLastError.KERNEL32 ref: 003E0A2E
ExitProcess.KERNEL32 ref: 003E0A32
lstrlenA.KERNEL32(30e44aa1), ref: 003E0A3D
_snprintf.MSVCRT(00000000,00000103,%08x,00000000,30e44aa1,00000000), ref: 003E0A60
ExitProcess.KERNEL32 ref: 003E0A79
ExitProcess.KERNEL32 ref: 003E0A98
GetModuleFileNameW.KERNEL32(00000000,0041AFB0,00000208), ref: 003E0ACC
wsprintfW.USER32(0041ADA0,%s\Microsoft\%s.exe,00000000,00000000), ref: 003E0ADE
WideCharToMultiByte.KERNEL32(00000000,00000000,0041ADA0,000000FF,0041AC50,00000104,00000000,00000000), ref: 003E0B06
lstrcpynW.KERNEL32(0041B1B8,00000000,00000208), ref: 003E0B13
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,0041B3E0,00000104,00000000,00000000), ref: 003E0B2E
Sleep.KERNEL32(000009C4), ref: 003E0B59
ExitProcess.KERNEL32 ref: 003E0B70

Strings

OPEN, xrefs: 003E09B8
ngrBot, xrefs: 003E0A84, 003E0AA3
running, xrefs: 003E0A7F, 003E0A9E
%s\Microsoft\%s.exe, xrefs: 003E0AD4
30e44aa1, xrefs: 003E0A38, 003E0A44
%08x, xrefs: 003E0A4F

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Process$Exitmemset$lstrlen$ByteCharErrorFileLastModuleMultiNameSleepWide_snprintf$CountExecuteHeapMutexOpenShellTick_vsnprintflstrcpynwsprintf
String ID: %08x$%s\Microsoft\%s.exe$30e44aa1$OPEN$ngrBot$running
API String ID: 2173303953-2917108782
Opcode ID: 6538089ac75dc441dbcc5e2ff1353eeb15020a9a869a10768152ffef778faaef
Instruction ID: 80fd95e48333533808185c41294b832c70153fe58fdf41648afe98b350f862a0
Opcode Fuzzy Hash: 6538089ac75dc441dbcc5e2ff1353eeb15020a9a869a10768152ffef778faaef
Instruction Fuzzy Hash: 3E51F976A803947BE722A7B1AC4BFDE3A2C9B44B11F404611F709FE2D2DAF455808766

Function 003DFE00 Relevance: 48.2, APIs: 32, Instructions: 223stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,003E037C,?,003E32E4,00000000,00000000,httpi), ref: 003DFE11
lstrlenA.KERNEL32(?), ref: 003DFE40
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003DFE47
lstrlenA.KERNEL32(?), ref: 003DFE5E
lstrlenA.KERNEL32(?), ref: 003DFE72
lstrlenA.KERNEL32(?), ref: 003DFE7C
HeapAlloc.KERNEL32(?,00000008,00000002), ref: 003DFE89
strtok.MSVCRT(?,003E19DC), ref: 003DFEA2
lstrcpyA.KERNEL32(00000000,003E1335), ref: 003DFEBB
lstrcatA.KERNEL32(00000000,003E19DC), ref: 003DFECD
lstrlenA.KERNEL32(00000000), ref: 003DFEE4
_memicmp.MSVCRT(?,00000000,00000000), ref: 003DFEEF
lstrcatA.KERNEL32(00000000,?), ref: 003DFF0A
lstrlenA.KERNEL32(?), ref: 003DFF14
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 003DFF1F
lstrlenA.KERNEL32(?), ref: 003DFF33
lstrcatA.KERNEL32(00000000,003E3328), ref: 003DFF4B
strstr.MSVCRT(?,003E2B54), ref: 003DFF5C
lstrlenA.KERNEL32(00000000), ref: 003DFF65
lstrlenA.KERNEL32(?), ref: 003DFF6B
strncat.MSVCRT(00000000,?,00000000), ref: 003DFF77
lstrcatA.KERNEL32(00000000,003E2B54), ref: 003DFF85
lstrlenA.KERNEL32(?), ref: 003DFF8F
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 003DFF9A
lstrlenA.KERNEL32(?), ref: 003DFFAA

Part of subcall function 003DFD80: isalnum.MSVCRT(00000000,00000000,756F59EB,00000000,?,003DFFB9,00000000,00000000,00000000), ref: 003DFDAC
Part of subcall function 003DFD80: strchr.MSVCRT(-_.!~*'(),00000000,00000000), ref: 003DFDBE

lstrcatA.KERNEL32(00000000,00000000), ref: 003DFFBE
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DFFCB
lstrcatA.KERNEL32(00000000,?), ref: 003DFFDF
strtok.MSVCRT(00000000,003E19DC), ref: 003DFFEC
HeapFree.KERNEL32(?,00000000,?), ref: 003E000F
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E001C
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E003C

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$Heap$lstrcat$AllocFree$strtok$Process_memicmpisalnumlstrcpystrchrstrncatstrstr
String ID:
API String ID: 423345748-0
Opcode ID: 7776314030eb92e533982b535381ed099873fbabf7ad05a1bff8aac9c5604b9c
Instruction ID: 1db263427b842fcc81f9757d02c1169591aca64c42ffe8026e0576619e646586
Opcode Fuzzy Hash: 7776314030eb92e533982b535381ed099873fbabf7ad05a1bff8aac9c5604b9c
Instruction Fuzzy Hash: 5E617E76A00295BFDB229BA5DC85EBF777CAF84700F104219F909DB380DAB4DD8187A0

Function 003D99B0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 205networkstringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003D99D5
memset.MSVCRT(?,00000000,00000103,?,00000000,00000103), ref: 003D99EF
WSAStartup.WS2_32(00000002,?), ref: 003D9A00

Part of subcall function 003D9300: inet_addr.WS2_32(n"=), ref: 003D9308
Part of subcall function 003D9300: gethostbyname.WS2_32(n"=), ref: 003D9313

htons.WS2_32(00000050), ref: 003D9A28
GetTickCount.KERNEL32(00000050,?), ref: 003D9A3A
GetTickCount.KERNEL32 ref: 003D9A4D
socket.WS2_32(00000002,00000001,00000000), ref: 003D9A7B
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 003D9A96
connect.WS2_32(?,?,00000010), ref: 003D9AB1
Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 003D9ABE
GetTickCount.KERNEL32 ref: 003D9AC4
lstrcpyA.KERNEL32(00000000,X-a: b), ref: 003D9AFE
lstrcpyA.KERNEL32(00000000,Connection: Close), ref: 003D9B0C
lstrlenA.KERNEL32(00000000), ref: 003D9B0F
send.WS2_32(?,00000000,00000000,00000000), ref: 003D9B41
Sleep.KERNEL32(000003E8,?,00000000,00000000,00000000), ref: 003D9B51
lstrlenA.KERNEL32(00000000), ref: 003D9B5E
GetTickCount.KERNEL32 ref: 003D9B66
Sleep.KERNEL32(000009C4), ref: 003D9B7F
send.WS2_32(?,00000000,00000000,00000000), ref: 003D9BBE
GetTickCount.KERNEL32(?,00000000,00000000,00000000), ref: 003D9BD2
lstrlenA.KERNEL32(00000000), ref: 003D9BE4
send.WS2_32(?,00000000,00000000,00000000), ref: 003D9C1E
closesocket.WS2_32(?), ref: 003D9C38
GetTickCount.KERNEL32(?,?,00000000,00000000,00000000), ref: 003D9C43

Strings

Connection: Close, xrefs: 003D9B00
X-a: b, xrefs: 003D9AF0

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CountTick$Sleeplstrlensend$lstrcpymemset$Startupclosesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
String ID: Connection: Close$X-a: b
API String ID: 1989272289-3524857483
Opcode ID: 341925862333dea0a401c31742a6b05a5b37fd9063005b15a84647de86a6087b
Instruction ID: c319e2e602829af6ecc6e99fdf333643b618fd15312b8b088e21d8ab1f7a8d99
Opcode Fuzzy Hash: 341925862333dea0a401c31742a6b05a5b37fd9063005b15a84647de86a6087b
Instruction Fuzzy Hash: AE71AE73900268ABD722DBB0EC85FDE776D9B88700F114A57EA09EB2C0D6709E41CB91

Function 003DAFA0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 149stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 003DAFBD
HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 003DAFCB
memset.MSVCRT(?,00000000,000003FF), ref: 003DAFE8
memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF), ref: 003DB002
lstrlenA.KERNEL32(?), ref: 003DB013
sscanf.MSVCRT(00000000,POST /%1023s,00000000,00000000,?,00000000), ref: 003DB02A
strtok.MSVCRT(00000000,003E2B84), ref: 003DB041
_memicmp.MSVCRT(00000000,Host: ,00000006), ref: 003DB05B
strtok.MSVCRT(00000000,003E2B84), ref: 003DB06E
lstrlenA.KERNEL32(-00000006), ref: 003DB082
lstrcpynA.KERNEL32(00000000,-00000006,00000001), ref: 003DB08E
lstrlenA.KERNEL32(00000000), ref: 003DB09B
lstrlenA.KERNEL32(00000000), ref: 003DB0AD
lstrlenA.KERNEL32(00000000), ref: 003DB0BB
lstrlenA.KERNEL32(00000000), ref: 003DB0C6
HeapAlloc.KERNEL32(?,00000000,?), ref: 003DB0D5
_memicmp.MSVCRT(00000000,HTTP,00000004), ref: 003DB0EB
_snprintf.MSVCRT(00000000,?,http://%s/,00000000), ref: 003DB106
_snprintf.MSVCRT(00000000,?,http://%s/%s,00000000,00000000), ref: 003DB125
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DB13C

Strings

http://%s/, xrefs: 003DB0FF
Host: , xrefs: 003DB055
HTTP, xrefs: 003DB0E3
http://%s/%s, xrefs: 003DB11E
POST /%1023s, xrefs: 003DB024

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$Heap$Alloc_memicmp_snprintfmemsetstrtok$Freelstrcpynsscanf
String ID: HTTP$Host: $POST /%1023s$http://%s/$http://%s/%s
API String ID: 3179755921-1264106924
Opcode ID: e4060a9ab81de6a378e2218679331c00fb608ed9bd7fb405b652eb89cb595b98
Instruction ID: 0c19122b79039c13f67a8b5ca9807d4892702dc055ad58ffc406c7087314fcd4
Opcode Fuzzy Hash: e4060a9ab81de6a378e2218679331c00fb608ed9bd7fb405b652eb89cb595b98
Instruction Fuzzy Hash: 144119B3D40268A7D726A7A19C42FEB736CDF84710F054690FB08A6281E7B09E458BE1

Function 003D6A40 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 166stringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003D6A68
lstrlenA.KERNEL32 ref: 003D6B03
_memicmp.MSVCRT(?,00000000,00000000), ref: 003D6B0E
_memicmp.MSVCRT(?,JOIN,00000004), ref: 003D6B22
_memicmp.MSVCRT(?,PRIVMSG,00000007), ref: 003D6B36
sscanf.MSVCRT(?,JOIN %255s,?), ref: 003D6B4F
sscanf.MSVCRT(?,PRIVMSG %255s,?), ref: 003D6B69
lstrlenA.KERNEL32(?), ref: 003D6BD5
SetFileAttributesW.KERNEL32(0041A710,00000080), ref: 003D6C31
MoveFileExW.KERNEL32(0041A710,00000000,00000004), ref: 003D6C40
closesocket.WS2_32(?), ref: 003D6C60
ExitThread.KERNEL32 ref: 003D6C67

Part of subcall function 003DA310: memset.MSVCRT ref: 003DA335
Part of subcall function 003DA310: memset.MSVCRT ref: 003DA34F
Part of subcall function 003DA310: memset.MSVCRT(?,00000000,000003FF), ref: 003DA369
Part of subcall function 003DA310: _vsnprintf.MSVCRT(?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA382
Part of subcall function 003DA310: sprintf.MSVCRT(00000000,003E13EC,?,?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA39A
Part of subcall function 003DA310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s,blk,?,?,000001FE,003E0A8E), ref: 003DA3AD
Part of subcall function 003DA310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s), ref: 003DA3CC
Part of subcall function 003DA310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB), ref: 003DA3DB
Part of subcall function 003DA310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 003DA3EC
Part of subcall function 003DA310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA3FB
Part of subcall function 003DA310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA404
Part of subcall function 003DA310: EnterCriticalSection.KERNEL32(0041AC34,?,?,00000000), ref: 003DA436
Part of subcall function 003DA310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 003DA452
Part of subcall function 003DA310: LeaveCriticalSection.KERNEL32(0041AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DA464

Strings

JOIN %255s, xrefs: 003D6B49
%s:%d, xrefs: 003D6AAD, 003D6BB2
pdef, xrefs: 003D6A8F
%s.Detected process "%S" sending an IRC packet to server %s:%d., xrefs: 003D6C0D
block, xrefs: 003D6BB7
%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s)., xrefs: 003D6BF2
PRIVMSG %255s, xrefs: 003D6B63
cnc, xrefs: 003D6AB2
PRIVMSG, xrefs: 003D6B30
JOIN, xrefs: 003D6B1C

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$memset$File_memicmp$CriticalSectionsprintfsscanf$AttributesCreateEnterExitLeaveMoveThread_snprintf_vsnprintfclosesocket
String ID: %s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).$%s.Detected process "%S" sending an IRC packet to server %s:%d.$%s:%d$JOIN$JOIN %255s$PRIVMSG$PRIVMSG %255s$block$cnc$pdef
API String ID: 1085873876-1467418891
Opcode ID: ad57af4fdd33459d1978493fbe514d14aff80ee509c775353f3178ecef303953
Instruction ID: 40268564898c2e59eab56419d9c26dc3686e5ead2f1c06034370adff3a56dd08
Opcode Fuzzy Hash: ad57af4fdd33459d1978493fbe514d14aff80ee509c775353f3178ecef303953
Instruction Fuzzy Hash: 4F510872A002547BDF239F56AC87FEE376CAB40704F050527F924A73C1E6B0A99486A2

Function 003E0050 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 135stringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103,00000000,00000000,00000000), ref: 003E0071
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 003E0080
lstrlenA.KERNEL32(00000000), ref: 003E00AB
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003E00B6
lstrcpyA.KERNEL32(00000000,00000000), ref: 003E00CB
lstrlenA.KERNEL32(00000000), ref: 003E00D2
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003E00E3
strtok.MSVCRT(00000000,003E2B84), ref: 003E00F9
strstr.MSVCRT(00000000,003E19DC), ref: 003E0117
strstr.MSVCRT(00000000,003E2B54), ref: 003E0129
lstrcatA.KERNEL32(00000000,003E2B84), ref: 003E0141
_memicmp.MSVCRT(00000000,Content-Length: ,00000010), ref: 003E014E
lstrcatA.KERNEL32(00000000,Content-Length: ), ref: 003E0160
_snprintf.MSVCRT(00000000,00000103,003E2B10,00000000), ref: 003E0177
lstrcatA.KERNEL32(00000000,00000000), ref: 003E018A
strtok.MSVCRT(00000000,003E2B84), ref: 003E0193
lstrcatA.KERNEL32(00000000,), ref: 003E01AB
lstrcatA.KERNEL32(00000000,00000000), ref: 003E01B2
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 003E01BE

Strings

, xrefs: 003E01A5
Content-Length: , xrefs: 003E0148, 003E015A

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrcat$Heap$Alloclstrlenstrstrstrtok$FreeProcess_memicmp_snprintflstrcpymemset
String ID: $Content-Length:
API String ID: 4006885983-3599722475
Opcode ID: 593dd18d424cbe01fd3e5286a7b0b05e3272a382d0440340a6ab01e9ab38379f
Instruction ID: df23ddb5b6cd69d3f02c2411ef8cb9ff2a1932305224657d326be39e35379039
Opcode Fuzzy Hash: 593dd18d424cbe01fd3e5286a7b0b05e3272a382d0440340a6ab01e9ab38379f
Instruction Fuzzy Hash: 9E4109356003A5BBD726AB629C85FEF776C9F54711F014314FD08AE2C1EBF49A818AA0

Function 003DA310 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 127stringfilesleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003DA335
memset.MSVCRT ref: 003DA34F
memset.MSVCRT(?,00000000,000003FF), ref: 003DA369
_vsnprintf.MSVCRT(?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA382
sprintf.MSVCRT(00000000,003E13EC,?,?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA39A
lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s,blk,?,?,000001FE,003E0A8E), ref: 003DA3AD
_snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s), ref: 003DA3CC
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB), ref: 003DA3DB
sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 003DA3EC
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA3FB
lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA404
EnterCriticalSection.KERNEL32(0041AC34,?,?,00000000), ref: 003DA436
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 003DA452
LeaveCriticalSection.KERNEL32(0041AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DA464
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 003DA484
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DA48B
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DA496
LeaveCriticalSection.KERNEL32(0041AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DA4A1

Strings

30e44aa1, xrefs: 003DA3A8, 003DA3B0, 003DA3FD, 003DA40E
%d., xrefs: 003DA3E6
\\.\pipe\%08x_ipc, xrefs: 003DA3BB

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$CriticalSectionmemset$FileLeavesprintf$CloseCreateEnterHandleSleepWrite_snprintf_vsnprintf
String ID: %d.$30e44aa1$\\.\pipe\%08x_ipc
API String ID: 4010528547-3602371622
Opcode ID: 700bcdec2084028057f61898a211a257a2cf50654c2bfedee42fccbf0c1ee404
Instruction ID: 7cf458987ab8181f45a436a59c6b0c6edc55f16d59d0a4aa0de4ee774582ea50
Opcode Fuzzy Hash: 700bcdec2084028057f61898a211a257a2cf50654c2bfedee42fccbf0c1ee404
Instruction Fuzzy Hash: B14120B65403587BD722E7A1DC86FEE733CDF88701F004694F708AA1C1D6F41A848B65

Function 003E01E0 Relevance: 36.2, APIs: 16, Strings: 8, Instructions: 189memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF,00000000,00000000,00000000), ref: 003E0202
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 003E0213
EnterCriticalSection.KERNEL32(0041B4E4), ref: 003E0223
strstr.MSVCRT(00000000,003E19DC), ref: 003E0243
lstrlenA.KERNEL32(00000000), ref: 003E0254
HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003E025F
lstrcpyA.KERNEL32(00000000,00000000), ref: 003E0272
strstr.MSVCRT(00000000,), ref: 003E0281
_snprintf.MSVCRT(00000000,000001FF,%s=,003E32E4), ref: 003E02C8
strstr.MSVCRT(?,00000000), ref: 003E02EF
atoi.MSVCRT(00000000,?,http,int), ref: 003E0322
lstrlenA.KERNEL32(00000000), ref: 003E0386
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E03E4
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E03EE
LeaveCriticalSection.KERNEL32(0041B4E4), ref: 003E03FD
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 003E041F

Strings

, xrefs: 003E027B
int, xrefs: 003E030E
httpspread, xrefs: 003E03A8
%s=, xrefs: 003E02B7
%s.%s hijacked!, xrefs: 003E03AD
msg, xrefs: 003E0344
httpi, xrefs: 003E0360
http, xrefs: 003E0316, 003E034C

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heap$Freestrstr$CriticalSectionlstrlen$AllocEnterLeaveProcess_snprintfatoilstrcpymemset
String ID: $%s.%s hijacked!$%s=$http$httpi$httpspread$int$msg
API String ID: 2097228407-1593535274
Opcode ID: 739d7b980c4c499480a26c14b78cbaefd4341615155723ce6308a73f184373ee
Instruction ID: f593838dcd3a470ad92d18fe610b6d1648fbc3cb4c8f2e724a07f085708a9900
Opcode Fuzzy Hash: 739d7b980c4c499480a26c14b78cbaefd4341615155723ce6308a73f184373ee
Instruction Fuzzy Hash: 29510A75A402A5ABDB279BA29C85BFF737CEB50700F004729F914A62C1DBF49D408BA1

Function 003DD220 Relevance: 34.7, APIs: 11, Strings: 12, Instructions: 209stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 003DD231
strstr.MSVCRT(?,MOTD), ref: 003DD249
strstr.MSVCRT(?,376), ref: 003DD25F
strtok.MSVCRT(?,003E2C78), ref: 003DD275
strtok.MSVCRT(00000000,003E2C78), ref: 003DD297
lstrcmpA.KERNEL32(?,PING), ref: 003DD2C1

Strings

376, xrefs: 003DD259
KCIK %s, xrefs: 003DD33C
332, xrefs: 003DD3D1
PPPPMSG, xrefs: 003DD37F
PING, xrefs: 003DD2BB
MOTD, xrefs: 003DD243
433, xrefs: 003DD31D
SEND %s %s, xrefs: 003DD308, 003DD43C
W>, xrefs: 003DD2F8, 003DD42B
001, xrefs: 003DD2EC
PPNG %s, xrefs: 003DD2D1
JOIN, xrefs: 003DD351

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: strstrstrtok$lstrcmplstrlen
String ID: W>$001$332$376$433$JOIN$KCIK %s$MOTD$PING$PPNG %s$PPPPMSG$SEND %s %s
API String ID: 4048585210-2775256916
Opcode ID: 6427e7d67f319657f38059b421aa9dd221d444ed5d73697d74d9a421a8465af4
Instruction ID: ab876750450a303c1cc23014a502dfa77a66396e53c42288306e46d32b72b813
Opcode Fuzzy Hash: 6427e7d67f319657f38059b421aa9dd221d444ed5d73697d74d9a421a8465af4
Instruction Fuzzy Hash: EE5139B7F4021967DB12B669BC82EAB736CDB80319F014667FC08DA381FA71ED5146E1

Function 003DAE00 Relevance: 34.7, APIs: 23, Instructions: 165stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,003D7CC2,00000000,003E2914,?,?,?,?,?,?), ref: 003DAE11
HeapAlloc.KERNEL32(?,00000008,00000001,?,003D7CC2,00000000,003E2914,?,?,?,?,?,?,?,00000000), ref: 003DAE23
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,?,00000000), ref: 003DAE41
strstr.MSVCRT(?,003E19DC), ref: 003DAE59
lstrcpyA.KERNEL32(00000000,?), ref: 003DAE70
lstrcpyA.KERNEL32(00000000,?), ref: 003DAE77
lstrcatA.KERNEL32(00000000,003E2B54), ref: 003DAE7F
strtok.MSVCRT(00000000,003E19DC), ref: 003DAE8E
lstrlenA.KERNEL32(00000000), ref: 003DAEA1
_strnicmp.MSVCRT(00000000,00000000,00000000), ref: 003DAEA6
strtok.MSVCRT(00000000,003E19DC), ref: 003DAEB9
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DAED5
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DAEEB
strstr.MSVCRT(00000000,003E2B54), ref: 003DAF10
lstrlenA.KERNEL32(00000001), ref: 003DAF20
lstrlenA.KERNEL32(00000001), ref: 003DAF27
??2@YAPAXI@Z.MSVCRT(00000001), ref: 003DAF2B
lstrlenA.KERNEL32(00000001), ref: 003DAF3D
lstrcpyA.KERNEL32(?,00000001), ref: 003DAF58
lstrlenA.KERNEL32(00000001,?,00000001), ref: 003DAF5F
lstrlenA.KERNEL32(00000001,?,00000001), ref: 003DAF6B
HeapFree.KERNEL32(?,00000000,00000000,?,00000001), ref: 003DAF82
HeapFree.KERNEL32(?,00000000,00000000,?,00000001), ref: 003DAF91

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$Heap$Free$lstrcpy$Allocstrstrstrtok$??2@_strnicmplstrcat
String ID:
API String ID: 3119447416-0
Opcode ID: c36fee33b67904ccd3c1177d72155f875c26d7deb399917bae9984f70a34bac8
Instruction ID: 9dd0e345b1aae6ede776ff25b2fe119c2e8e090151771e71fcb0376593987c44
Opcode Fuzzy Hash: c36fee33b67904ccd3c1177d72155f875c26d7deb399917bae9984f70a34bac8
Instruction Fuzzy Hash: C941B276601364ABCB229BA5ED81FAF73ACEF45700F144119FA049B380DB74ED11C7A6

Function 003D7C00 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 175stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT(00000000,003E19DC,00000000,00000000), ref: 003D7C62
_stricmp.MSVCRT(?,cPanel,blog,%s-%s-%s,?,?,00000000), ref: 003D7D58
_stricmp.MSVCRT(00000000,WHM), ref: 003D7D71
_stricmp.MSVCRT(?,WHCMS), ref: 003D7D8A
_stricmp.MSVCRT(?,Directadmin), ref: 003D7DA3

Part of subcall function 003DA310: memset.MSVCRT ref: 003DA335
Part of subcall function 003DA310: memset.MSVCRT ref: 003DA34F
Part of subcall function 003DA310: memset.MSVCRT(?,00000000,000003FF), ref: 003DA369
Part of subcall function 003DA310: _vsnprintf.MSVCRT(?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA382
Part of subcall function 003DA310: sprintf.MSVCRT(00000000,003E13EC,?,?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA39A
Part of subcall function 003DA310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s,blk,?,?,000001FE,003E0A8E), ref: 003DA3AD
Part of subcall function 003DA310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s), ref: 003DA3CC
Part of subcall function 003DA310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB), ref: 003DA3DB
Part of subcall function 003DA310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 003DA3EC
Part of subcall function 003DA310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA3FB
Part of subcall function 003DA310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA404
Part of subcall function 003DA310: EnterCriticalSection.KERNEL32(0041AC34,?,?,00000000), ref: 003DA436
Part of subcall function 003DA310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 003DA452
Part of subcall function 003DA310: LeaveCriticalSection.KERNEL32(0041AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DA464

??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 003D7E02
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 003D7E12

Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF), ref: 003D7401
Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 003D7419
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D7431
Part of subcall function 003D73E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 003D7449
Part of subcall function 003D73E0: _vsnprintf.MSVCRT(?,000001FE,003E0A8E,?), ref: 003D746B
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D747A

Part of subcall function 003D7330: memset.MSVCRT(?,00000000,000001FF), ref: 003D7351
Part of subcall function 003D7330: lstrlenA.KERNEL32(?), ref: 003D7369
Part of subcall function 003D7330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 003D7381
Part of subcall function 003D7330: _vsnprintf.MSVCRT(00000000,000001FE,003E0AAD,?), ref: 003D73A3
Part of subcall function 003D7330: lstrlenA.KERNEL32(00000000), ref: 003D73B2

Strings

%s-%s-%s, xrefs: 003D7D11, 003D7D3C
Directadmin, xrefs: 003D7D9D
httplogin, xrefs: 003D7DBF, 003D7DE7
%s.%s ->> %s (%s : %s), xrefs: 003D7DEC
WHCMS, xrefs: 003D7D84
4)>, xrefs: 003D7C75, 003D7C81
cPanel, xrefs: 003D7D52
WHM, xrefs: 003D7D6B
iegrab, xrefs: 003D7C34
ffgrab, xrefs: 003D7C41
%s.%s ->> %s : %s, xrefs: 003D7DC4
blog, xrefs: 003D7D16, 003D7D41

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$memset$_stricmp$_snprintf_vsnprintf$??3@CriticalSectionsprintf$CreateEnterFileLeavestrstr
String ID: %s-%s-%s$%s.%s ->> %s (%s : %s)$%s.%s ->> %s : %s$4)>$Directadmin$WHCMS$WHM$blog$cPanel$ffgrab$httplogin$iegrab
API String ID: 3716863481-3181307524
Opcode ID: a13d14a297b4a55a1ec9ce18f659adaaf63f151f3375cffe85986f53be40baec
Instruction ID: f4a03d5745479a937370feb66a53a16a7a7b4e28a962c3e4337f9acab75369c1
Opcode Fuzzy Hash: a13d14a297b4a55a1ec9ce18f659adaaf63f151f3375cffe85986f53be40baec
Instruction Fuzzy Hash: 7E51EB76D04265ABDB13DB96AD82DBB736DAF50740F44061AF801973C1F670ED41CBA2

Function 003D25D0 Relevance: 31.7, APIs: 7, Strings: 14, Instructions: 191stringmemoryCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT(?,CAL %d %256s,?,003E7008), ref: 003D260F

Part of subcall function 003E07D0: lstrlenA.KERNEL32(*&=,?,?,00000000,?,003D262A,?,003E7008), ref: 003E07DC
Part of subcall function 003E07D0: lstrcpyA.KERNEL32(00000000,*&=,?,003E7008), ref: 003E07F9

strstr.MSVCRT(?,X-MMS-IM-Format:), ref: 003D264F

Part of subcall function 003D7700: memset.MSVCRT(?,00000000,000001FF), ref: 003D771E
Part of subcall function 003D7700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 003D7738
Part of subcall function 003D7700: lstrlenA.KERNEL32(00000000), ref: 003D7747

atoi.MSVCRT(00000000), ref: 003D26FB
atoi.MSVCRT(00000000), ref: 003D2713
lstrlenA.KERNEL32(00000000), ref: 003D276B
lstrlenA.KERNEL32(00000000,00000000), ref: 003D278C
HeapFree.KERNEL32(?,00000000,00000000), ref: 003D27F9

Strings

%s.p10-> Message hijacked!, xrefs: 003D27E2
msnmsg, xrefs: 003D2748
baddr, xrefs: 003D26A8, 003D26C3
msnint, xrefs: 003D26E0
CAL %d %256s, xrefs: 003D2609
%s.p21-> Message hijacked!, xrefs: 003D27B7
%s.p10-> Message to %s hijacked!, xrefs: 003D27C8
CAL , xrefs: 003D25DD
MSG , xrefs: 003D2672
SDG , xrefs: 003D263E
msnu, xrefs: 003D25EE, 003D2660
msn, xrefs: 003D27B2, 003D27C3, 003D27DD
X-MMS-IM-Format:, xrefs: 003D2649
MSG , xrefs: 003D2637

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$atoi$FreeHeap_snprintflstrcpymemsetsscanfstrstr
String ID: %s.p10-> Message hijacked!$%s.p10-> Message to %s hijacked!$%s.p21-> Message hijacked!$CAL $CAL %d %256s$MSG $MSG $SDG $X-MMS-IM-Format:$baddr$msn$msnint$msnmsg$msnu
API String ID: 1527159713-2027340701
Opcode ID: 5d97c240b15b5f7f0e352998f92e10198408d1865a6850ec7d6b299207b56944
Instruction ID: 52a1370054c9857e5899398052c7c403657da723e04da68524eb1ad7a1963f7e
Opcode Fuzzy Hash: 5d97c240b15b5f7f0e352998f92e10198408d1865a6850ec7d6b299207b56944
Instruction Fuzzy Hash: DA515B77E0439067CB336BA67CC2EEF7368DB61310F50466BF804A63C2E6B599508693

Function 003DEFE0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?), ref: 003DEFF4
memset.MSVCRT ref: 003DF011
memset.MSVCRT(?,00000000,000007FF), ref: 003DF02B
PathFindExtensionA.SHLWAPI(?,.lnk), ref: 003DF039
lstrcmpA.KERNEL32(00000000), ref: 003DF046
lstrcmpA.KERNEL32(?,003E13D8), ref: 003DF056
lstrcmpA.KERNEL32(?,003E2FCC), ref: 003DF066
lstrcmpA.KERNEL32(?,RECYCLED), ref: 003DF08F
strrchr.MSVCRT(?,0000005C), ref: 003DF09C
strrchr.MSVCRT(?,0000005C,?,0000005C), ref: 003DF0A9
_snprintf.MSVCRT(?,000007FF,/c "start %%cd%%RECYCLED\%s,00000001), ref: 003DF0CC
_snprintf.MSVCRT(?,000007FF,&&%%windir%%\explorer.exe %%cd%%%s,00000001,?,000007FF,/c "start %%cd%%RECYCLED\%s,00000001), ref: 003DF0E4
SetFileAttributesA.KERNEL32(?,00000006), ref: 003DF109

Strings

/c "start %%cd%%RECYCLED\%s, xrefs: 003DF0BB
.lnk, xrefs: 003DF033
%windir%\system32\cmd.exe, xrefs: 003DF0F9
&&%%windir%%\explorer.exe %%cd%%%s, xrefs: 003DF0D3
RECYCLED, xrefs: 003DF089

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrcmp$AttributesFile_snprintfmemsetstrrchr$ExtensionFindPath
String ID: %windir%\system32\cmd.exe$&&%%windir%%\explorer.exe %%cd%%%s$.lnk$/c "start %%cd%%RECYCLED\%s$RECYCLED
API String ID: 1691573101-2902080580
Opcode ID: 9386da8ab0e8297f1abfbff3a10014aaa50d97d438672f82a70ab2e770da5402
Instruction ID: 4bd90dbf50c321e74519aea3d07b2a31a8f67e947d027c78095aa0b2b9f0ffd6
Opcode Fuzzy Hash: 9386da8ab0e8297f1abfbff3a10014aaa50d97d438672f82a70ab2e770da5402
Instruction Fuzzy Hash: 7C31F8736403A56AD723B665EC42FEB336CEF88741F040275FA0DA51C1DBB499458AB1

Function 003DE590 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 141stringmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003DE5B0
EnterCriticalSection.KERNEL32(0041B3C8), ref: 003DE5C9
strtok.MSVCRT(?,003E2B84), ref: 003DE5FE
strstr.MSVCRT(00000000,003E13D8), ref: 003DE617
strstr.MSVCRT(00000000,003E2C78), ref: 003DE62D
strstr.MSVCRT(00000000,003E13D8), ref: 003DE642
lstrlenA.KERNEL32(00000000), ref: 003DE655
lstrlenA.KERNEL32(00000000), ref: 003DE65B
lstrcpyA.KERNEL32(00000000,003E1335), ref: 003DE678
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 003DE687

Part of subcall function 003D7500: lstrlenA.KERNEL32(?), ref: 003D752B
Part of subcall function 003D7500: _snprintf.MSVCRT(?,000001FF,%s_,?), ref: 003D7547
Part of subcall function 003D7500: _vsnprintf.MSVCRT(?,000001FF,00000000,?), ref: 003D7569
Part of subcall function 003D7500: lstrcmpA.KERNEL32(?,bdns), ref: 003D758B
Part of subcall function 003D7500: StrStrIA.SHLWAPI(?,00000000), ref: 003D759F
Part of subcall function 003D7500: lstrlenA.KERNEL32(?), ref: 003D75B9

strtok.MSVCRT(00000000,003E2B84), ref: 003DE6CF
HeapFree.KERNEL32(?,00000000,?), ref: 003DE71E
??3@YAXPAX@Z.MSVCRT(?), ref: 003DE72D
LeaveCriticalSection.KERNEL32(0041B3C8), ref: 003DE73A

Part of subcall function 003DAA10: memset.MSVCRT(?,00000000,00000103), ref: 003DAA31
Part of subcall function 003DAA10: lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 003DAA45
Part of subcall function 003DAA10: InternetOpenA.WININET(00000000,?,?,?,?), ref: 003DAA60
Part of subcall function 003DAA10: lstrlenA.KERNEL32(?), ref: 003DAA78
Part of subcall function 003DAA10: InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 003DAA8C

Strings

[DNS]: Blocked %d domain(s) - Redirected %d domain(s), xrefs: 003DE6FE
block, xrefs: 003DE6B7
bdns, xrefs: 003DE699, 003DE6B2

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$strstr$CriticalInternetOpenSectionlstrcpymemsetstrtok$??3@EnterFreeHeapLeave_snprintf_vsnprintflstrcmplstrcpyn
String ID: [DNS]: Blocked %d domain(s) - Redirected %d domain(s)$bdns$block
API String ID: 1940452476-536441337
Opcode ID: b03e4564b27957440a23433b9a5810ff8857fd0800ef8b604f262e5b2515a938
Instruction ID: 6348a63dd90e52ecb5363f48e68823f91cd7050f5e7251bb03177809b142191f
Opcode Fuzzy Hash: b03e4564b27957440a23433b9a5810ff8857fd0800ef8b604f262e5b2515a938
Instruction Fuzzy Hash: D2411B76D003687BC723A7A5AC82DFF7B7CDB90700F140256F905AA281E6B09E4086A1

Function 003D1290 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 146threadCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 003D12BE
wcsstr.MSVCRT(?,003E1378), ref: 003D12FD
wcsstr.MSVCRT(?,\\.\pipe), ref: 003D1313
wcsstr.MSVCRT(?,DBWIN), ref: 003D1325
SetFileAttributesW.KERNEL32(?,00000080), ref: 003D1368
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 003D1373
ExitThread.KERNEL32 ref: 003D1416

Strings

DBWIN, xrefs: 003D131F
dll, xrefs: 003D134C
ruskill, xrefs: 003D13E3
brk, xrefs: 003D1383, 003D139A
%s.%S, xrefs: 003D13E8
\\.\pipe, xrefs: 003D130D
exe, xrefs: 003D1335

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Filewcsstr$Attributes$ExitMoveThread
String ID: %s.%S$DBWIN$\\.\pipe$brk$dll$exe$ruskill
API String ID: 294512176-1976196219
Opcode ID: ccd532b7e903d9985cda4314a222243ea7bd3489420203ad3157ecad1ca8e662
Instruction ID: 37c829ea428e5220feaddb97e5d2eb9938f591637ea7ac3bd8e603ee44bce6ae
Opcode Fuzzy Hash: ccd532b7e903d9985cda4314a222243ea7bd3489420203ad3157ecad1ca8e662
Instruction Fuzzy Hash: 7841FF7A600255BBDB239F52BC86FDF336CEB58351F05022AF904963C0EB70AD4086A2

Function 003DB300 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 129stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000208), ref: 003DB312
HeapAlloc.KERNEL32(00000000), ref: 003DB319
memset.MSVCRT(?,00000000,00000206), ref: 003DB339
memset.MSVCRT(?,00000000,00000206,?,00000000,00000206), ref: 003DB354
GetWindowsDirectoryW.KERNEL32(?,00000208), ref: 003DB387
lstrcpynW.KERNEL32(?,?,00000004), ref: 003DB3A1
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 003DB3BB
lstrlenA.KERNEL32(30e44aa1), ref: 003DB3D8
lstrlenA.KERNEL32(30e44aa1), ref: 003DB3F0
lstrcatW.KERNEL32(00000000,.exe), ref: 003DB461

Strings

30e44aa1, xrefs: 003DB3D3, 003DB3EA
.exe, xrefs: 003DB45B
lol.exe, xrefs: 003DB366
lol, xrefs: 003DB371

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heaplstrlenmemset$AllocDirectoryInformationProcessVolumeWindowslstrcatlstrcpyn
String ID: .exe$30e44aa1$lol$lol.exe
API String ID: 1748614950-52295467
Opcode ID: 129d5ab4e021da50ecc962b97d80529d177d10a18fbddd3d37e5878c9279055d
Instruction ID: d2c403bfb5887a3dc3afc68f331ec836dcbe6c9f2a87c841abfaac419e325696
Opcode Fuzzy Hash: 129d5ab4e021da50ecc962b97d80529d177d10a18fbddd3d37e5878c9279055d
Instruction Fuzzy Hash: 7B415BB1601364E6C721CB66DC45AEFFBBDEF84311F0082A6F518D6291E7B88E40D7A5

Function 003DAA10 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157networkstringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003DAA31
lstrcpyA.KERNEL32(00000000,Mozilla/4.0), ref: 003DAA45
InternetOpenA.WININET(00000000,?,?,?,?), ref: 003DAA60
lstrlenA.KERNEL32(?), ref: 003DAA78
InternetOpenUrlA.WININET(?,?,?,00000000,04000000,00000000), ref: 003DAA8C
HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 003DAAC0
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 003DAAE2
??2@YAPAXI@Z.MSVCRT(00001000), ref: 003DAB15
InternetReadFile.WININET(00000000,?,00000FF8,00000001), ref: 003DAB67
??2@YAPAXI@Z.MSVCRT(?), ref: 003DAB85
??3@YAXPAX@Z.MSVCRT(00000000), ref: 003DABA5
InternetCloseHandle.WININET(00000000), ref: 003DABE7

Strings

Mozilla/4.0, xrefs: 003DAA39

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Internet$??2@OpenQuery$??3@AvailableCloseDataFileHandleHttpInfoReadlstrcpylstrlenmemset
String ID: Mozilla/4.0
API String ID: 2392773942-2634101963
Opcode ID: 2ed69a3993d2c152394e42fa77ab4c94001d30c3665b2c2998835b9ce7c447a5
Instruction ID: 05a42c4d6388cb9cf98d000b8daeae0dee4b3463d7a332369121fb76ec500742
Opcode Fuzzy Hash: 2ed69a3993d2c152394e42fa77ab4c94001d30c3665b2c2998835b9ce7c447a5
Instruction Fuzzy Hash: AB518A71A00245ABD722DF59ED84BEA77ECEB88700F04867EE908DB290D7709945CF95

Function 003DEE40 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142stringcomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(003E3634,00000000,00000001,003E3614,?), ref: 003DEE5B
memset.MSVCRT(?,00000000,00000207), ref: 003DEE81
lstrcpyA.KERNEL32(00000000,?), ref: 003DEE9A
lstrcatA.KERNEL32(00000000,003E2C78), ref: 003DEEAE
lstrcatA.KERNEL32(00000000,?), ref: 003DEEBB
memset.MSVCRT(?,00000000,0000015C), ref: 003DEED5
SHGetFileInfoA.SHELL32(?,00000000,00000000,00000160,00001000), ref: 003DEEF4
memset.MSVCRT(?,00000000,00000107), ref: 003DEF68
lstrcpyA.KERNEL32(00000000,?), ref: 003DEF7B
lstrcatA.KERNEL32(00000000,.lnk), ref: 003DEF89
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 003DEFA4

Strings

shell32.dll, xrefs: 003DEF25
.lnk, xrefs: 003DEF7D

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrcatmemset$lstrcpy$ByteCharCreateFileInfoInstanceMultiWide
String ID: .lnk$shell32.dll
API String ID: 3196525290-3399515747
Opcode ID: 7a6449aa8b09d6bd2bf3cec2d0f4304fedd0933a898fe0be89b673b6a8d21f5d
Instruction ID: 5463c1652e749f277797f16eb2b89de6a52ada2ce9d29776e872d601c4e77962
Opcode Fuzzy Hash: 7a6449aa8b09d6bd2bf3cec2d0f4304fedd0933a898fe0be89b673b6a8d21f5d
Instruction Fuzzy Hash: 63514075A00258AFDB55DB94CC85FDAB3BCAF8C700F104698F608EB2D0D6B0AE45CB64

Function 003D2220 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FF), ref: 003D2243
WSAStartup.WS2_32(00000202,?), ref: 003D2257

Part of subcall function 003D9300: inet_addr.WS2_32(n"=), ref: 003D9308
Part of subcall function 003D9300: gethostbyname.WS2_32(n"=), ref: 003D9313

htons.WS2_32(00000050), ref: 003D2288
socket.WS2_32(00000002,00000001,00000006), ref: 003D2297
connect.WS2_32(00000000,?,00000010), ref: 003D22AE
GetTickCount.KERNEL32 ref: 003D22C3
GetTickCount.KERNEL32 ref: 003D22F4
GetTickCount.KERNEL32 ref: 003D2307
send.WS2_32(00000000,00000000,00000400,00000000), ref: 003D2344
GetTickCount.KERNEL32 ref: 003D2350
closesocket.WS2_32(00000000), ref: 003D2363

Strings

i.root-servers.org, xrefs: 003D2264
gfff, xrefs: 003D2379

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CountTick$Startupclosesocketconnectgethostbynamehtonsinet_addrmemsetsendsocket
String ID: gfff$i.root-servers.org
API String ID: 99835129-3534201491
Opcode ID: e1487b2a81e42798eea6ce5c2a78ab008f2a6f44adf2ce762e4aa053aa18dad8
Instruction ID: 5f7dfedf731dc991d9b78886d0a81204c78373367e112818497849a9339cfeae
Opcode Fuzzy Hash: e1487b2a81e42798eea6ce5c2a78ab008f2a6f44adf2ce762e4aa053aa18dad8
Instruction Fuzzy Hash: 88314EB3B0021857DB1AD66DAC427BFB2698F94710F444676FA0CEB3C0E9B49D4147D6

Function 003D9830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FF), ref: 003D9850
strtok.MSVCRT(?,003E29EC), ref: 003D986E
HeapFree.KERNEL32(?,00000000,?), ref: 003D988B
lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 003D98A8
strtok.MSVCRT(00000000,003E29EC), ref: 003D98B5
HeapFree.KERNEL32(?,00000000,?), ref: 003D98D1
HeapFree.KERNEL32(?,00000000,?), ref: 003D999C

Strings

[UDP]: Finished flood on "%s:%d", xrefs: 003D9970
[UDP]: Starting flood on "%s:%d" for %d second(s), xrefs: 003D993A

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: FreeHeap$strtok$lstrcpynmemset
String ID: [UDP]: Finished flood on "%s:%d"$[UDP]: Starting flood on "%s:%d" for %d second(s)
API String ID: 216847750-2644890838
Opcode ID: 5e17c38109a90a1f93c0ac666748f1b4b176a2d0b6450c772f9fec0c7271ad70
Instruction ID: ed51031e9849e3ccac9d697ed01251682ca186f06f811a69abf6e79bb38495a0
Opcode Fuzzy Hash: 5e17c38109a90a1f93c0ac666748f1b4b176a2d0b6450c772f9fec0c7271ad70
Instruction Fuzzy Hash: 6731ECF35402986BD722A7A1BC86FAB336CEB84705F04426EFF089A2C1D6719D148766

Function 003D96B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FF), ref: 003D96D0
strtok.MSVCRT(?,003E29EC), ref: 003D96EE
HeapFree.KERNEL32(?,00000000,?), ref: 003D970B
lstrcpynA.KERNEL32(00000000,00000000,00000400), ref: 003D9728
strtok.MSVCRT(00000000,003E29EC), ref: 003D9735
HeapFree.KERNEL32(?,00000000,?), ref: 003D9751
HeapFree.KERNEL32(?,00000000,?), ref: 003D981C

Strings

[SYN]: Starting flood on "%s:%d" for %d second(s), xrefs: 003D97BA
[SYN]: Finished flood on "%s:%d", xrefs: 003D97F0

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: FreeHeap$strtok$lstrcpynmemset
String ID: [SYN]: Finished flood on "%s:%d"$[SYN]: Starting flood on "%s:%d" for %d second(s)
API String ID: 216847750-3475151101
Opcode ID: 64d7b8244fbfdc1afa4d47cb7060f5ba771a40b01b51bcfd978bc403f22fd462
Instruction ID: 0b51aa73500d7dadcedef1ebff83c5d6c2a860ee5eabf3a50e5a962dfd4ef995
Opcode Fuzzy Hash: 64d7b8244fbfdc1afa4d47cb7060f5ba771a40b01b51bcfd978bc403f22fd462
Instruction Fuzzy Hash: 7F31EAB35403986BD732A7A1BC86FBB336CEB45705F04427AFF099A2C1D6709D1486A5

Function 003E0C80 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003E0C89
GetModuleFileNameA.KERNEL32(00000000,0041AA28,00000104), ref: 003E0C9F
GetModuleFileNameW.KERNEL32(00000000,0041A710,00000208), ref: 003E0CB0
GetWindowsDirectoryA.KERNEL32(0041AB30,00000104), ref: 003E0CC0

Part of subcall function 003D19F0: wcsrchr.MSVCRT(?,0000005C,?,003D6965,?,?,?), ref: 003D19F9

InitializeCriticalSection.KERNEL32(0041AC34), ref: 003E0CE3
InitializeCriticalSection.KERNEL32(0041B4E4), ref: 003E0CEA
MoveFileExW.KERNEL32(0041A710,00000000,00000004), ref: 003E0DA5

Part of subcall function 003DA150: memset.MSVCRT(?,00000000,00000206,?), ref: 003DA170
Part of subcall function 003DA150: GetWindowsDirectoryW.KERNEL32(?,00000208,?,?,?), ref: 003DA184
Part of subcall function 003DA150: _memicmp.MSVCRT(?,?,00000000,?,00000000,?,?,?), ref: 003DA1C3

SetFileAttributesW.KERNEL32(0041A710,00000080), ref: 003E0D96
CreateThread.KERNEL32(00000000,00000000,Function_0000E9F0,00000000,00000000,00000000), ref: 003E0DED
CloseHandle.KERNEL32(00000000), ref: 003E0DF4

Strings

ruskill, xrefs: 003E0DB4
brk, xrefs: 003E0D57, 003E0D72
%s.%S, xrefs: 003E0DB9

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: File$CriticalDirectoryInitializeModuleNameSectionWindows$AttributesCloseCreateHandleHeapMoveProcessThread_memicmpmemsetwcsrchr
String ID: %s.%S$brk$ruskill
API String ID: 2870590860-2269373653
Opcode ID: d22853357a2bb9a239e8f1cef5611cc4b6f43c9142a50b94bb1dc212138b57d0
Instruction ID: 2e78a9ac1921c193e5319e523ebe6c311dcbf9479bd37a7e1dc8858157051011
Opcode Fuzzy Hash: d22853357a2bb9a239e8f1cef5611cc4b6f43c9142a50b94bb1dc212138b57d0
Instruction Fuzzy Hash: CB3128357813D0B7D33367A26D4BFDA37A89B00B54F140222F601E92D1D7F4A491875B

Function 003DA880 Relevance: 22.6, APIs: 2, Strings: 13, Instructions: 60COMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF), ref: 003DA89E

Part of subcall function 003D7790: memset.MSVCRT(?,00000000,00000103), ref: 003D77AE
Part of subcall function 003D7790: memset.MSVCRT(?,00000000,000001FF,?,00000000,00000103), ref: 003D77C8
Part of subcall function 003D7790: lstrcpyA.KERNEL32(00000000,off), ref: 003D77F0
Part of subcall function 003D7790: _snprintf.MSVCRT(00000000,000001FF,state_%s,?), ref: 003D780D
Part of subcall function 003D7790: lstrlenA.KERNEL32(00000000), ref: 003D7822
Part of subcall function 003D7790: lstrlenA.KERNEL32(00000000), ref: 003D7858

_snprintf.MSVCRT(00000000,000001FF,003E2B10,00000539,httpi,00000001,usbi,00000000,bdns,00000001), ref: 003DA936

Part of subcall function 003D7500: lstrlenA.KERNEL32(?), ref: 003D752B
Part of subcall function 003D7500: _snprintf.MSVCRT(?,000001FF,%s_,?), ref: 003D7547
Part of subcall function 003D7500: _vsnprintf.MSVCRT(?,000001FF,00000000,?), ref: 003D7569
Part of subcall function 003D7500: lstrcmpA.KERNEL32(?,bdns), ref: 003D758B
Part of subcall function 003D7500: StrStrIA.SHLWAPI(?,00000000), ref: 003D759F
Part of subcall function 003D7500: lstrlenA.KERNEL32(?), ref: 003D75B9

Strings

int, xrefs: 003DA93B
ftpgrab, xrefs: 003DA8E1
httpi, xrefs: 003DA914
bdns, xrefs: 003DA8FC
ffgrab, xrefs: 003DA8C9
pdef, xrefs: 003DA8BD
msg, xrefs: 003DA951
msnu, xrefs: 003DA8B1
msn, xrefs: 003DA8A5
popgrab, xrefs: 003DA8ED
usbi, xrefs: 003DA908
http, xrefs: 003DA946, 003DA956
iegrab, xrefs: 003DA8D5

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$_snprintfmemset$_vsnprintflstrcmplstrcpy
String ID: bdns$ffgrab$ftpgrab$http$httpi$iegrab$int$msg$msn$msnu$pdef$popgrab$usbi
API String ID: 3955240783-2907616027
Opcode ID: 6ba83768f0b55d604ead61096c6d4135037e6175cd0badda21b470dc3cf6a476
Instruction ID: a4cf55d3f2a2ea91c3ca83e30221de93a6b6186e5156a58b4db5ef39b4babbd2
Opcode Fuzzy Hash: 6ba83768f0b55d604ead61096c6d4135037e6175cd0badda21b470dc3cf6a476
Instruction Fuzzy Hash: 3A115FB9BE93A775E663B6A26CC3FF922194B40F04F400755F1087D2C2BAF12550C166

Function 003D17E0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003D180E
memset.MSVCRT(?,00000000,00000206,?,00000000,00000103), ref: 003D1829
wcsstr.MSVCRT(00000000,003E13F0), ref: 003D1842
lstrcmpA.KERNEL32(00000000,block), ref: 003D1888
strstr.MSVCRT(00000000,003E13D8), ref: 003D1898
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000208), ref: 003D18B7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 003D1905

Strings

block, xrefs: 003D1882
brk, xrefs: 003D1998, 003D19AF
bdns, xrefs: 003D185B, 003D1922
rdns, xrefs: 003D19BA
%s.%S, xrefs: 003D19BF

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ByteCharMultiWidememset$lstrcmpstrstrwcsstr
String ID: %s.%S$bdns$block$brk$rdns
API String ID: 695720605-4000218262
Opcode ID: 9963e2cd05c55f07b419160d30b621fdf84b9b5d78b737c8ed0f2706ab9d5c27
Instruction ID: d193794f454b3ba2c796856561971b94640f0664144e8ee808b827d66e23f738
Opcode Fuzzy Hash: 9963e2cd05c55f07b419160d30b621fdf84b9b5d78b737c8ed0f2706ab9d5c27
Instruction Fuzzy Hash: 18511676A00254BBDB22DB55FC56FEB37AC9B95710F04422AF900A62C1E7B0DA45C7E2

Function 003D10A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 102stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003D10C0
lstrcmpW.KERNEL32(?,0041ADA0), ref: 003D10D7
lstrcmpW.KERNEL32(?,0041A710), ref: 003D111D
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 003D1127
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 003D1161
lstrcpyA.KERNEL32(003E6D88,00000000), ref: 003D1179
lstrcpyA.KERNEL32(00000000,003E1335), ref: 003D1187
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 003D11A0
lstrcpyA.KERNEL32(003E6E90,00000000), ref: 003D11B3

Part of subcall function 003D7700: memset.MSVCRT(?,00000000,000001FF), ref: 003D771E
Part of subcall function 003D7700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 003D7738
Part of subcall function 003D7700: lstrlenA.KERNEL32(00000000), ref: 003D7747

Strings

pdef, xrefs: 003D10DD
ruskill, xrefs: 003D1132
%s.%S, xrefs: 003D1137

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrcpy$ByteCharMultiWidelstrcmpmemset$FileMove_snprintflstrlen
String ID: %s.%S$pdef$ruskill
API String ID: 1230166232-1410347113
Opcode ID: 9613b678889bf7240efcfa66a3f445c7d47a4bba33136c21d06312e3340ae8d4
Instruction ID: 499aa9c500a3b36d0c8946992fe96e0a89d9a3edfc391df39a97d3b45b8056b8
Opcode Fuzzy Hash: 9613b678889bf7240efcfa66a3f445c7d47a4bba33136c21d06312e3340ae8d4
Instruction Fuzzy Hash: 2531F8B6740368BBE7329755AC82FEA736CDB95B10F000256FB54AA2C1D7F0ED80C665

Function 003D73E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF), ref: 003D7401
memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 003D7419
lstrlenA.KERNEL32(?), ref: 003D7431
_snprintf.MSVCRT(?,000001FE,%s_,?), ref: 003D7449
_vsnprintf.MSVCRT(?,000001FE,003E0A8E,?), ref: 003D746B
lstrlenA.KERNEL32(?), ref: 003D747A
_memicmp.MSVCRT(?,block,00000004), ref: 003D74B0
_vsnprintf.MSVCRT(?,000001FE,003E0A8E,?), ref: 003D74D0

Strings

blk, xrefs: 003D74DC
%s_, xrefs: 003D7438
block, xrefs: 003D74AA
%s.%s, xrefs: 003D74E1

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: _vsnprintflstrlenmemset$_memicmp_snprintf
String ID: %s.%s$%s_$blk$block
API String ID: 3657324510-3589362310
Opcode ID: bd15c963fcb5d3e21bb0a559a50114939e49fd2e52f2edfb6e9a3c463ee44b6a
Instruction ID: 1ac1fb0a4cbb6b3c68503304d4c3ce05e8bde89dc2f058cfd1a51b55fed65e93
Opcode Fuzzy Hash: bd15c963fcb5d3e21bb0a559a50114939e49fd2e52f2edfb6e9a3c463ee44b6a
Instruction Fuzzy Hash: B421327794025D7BE712EA59DC82FFB336CDB84704F4445B9FA08971C1F5709E4586A0

Function 003D9580 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003D95A4
memset.MSVCRT(?,00000000,000007FF), ref: 003D95BE
memset.MSVCRT(?,00000000,00000103,?,00000000,000007FF), ref: 003D95D8
GetTickCount.KERNEL32 ref: 003D95E0
lstrcpyA.KERNEL32(?,Mozilla/4.0), ref: 003D9611
lstrcpyA.KERNEL32(?,GET), ref: 003D9664
sprintf.MSVCRT(?,%s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42,?,?,?,?), ref: 003D9685
strtok.MSVCRT(?,003E2960,?,%s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42,?,?,?,?), ref: 003D9696

Strings

POST, xrefs: 003D963C, 003D964A
%s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42, xrefs: 003D967F
Mozilla/4.0, xrefs: 003D9602
GET, xrefs: 003D9658

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: memset$lstrcpy$CountTicksprintfstrtok
String ID: %s / ?%d HTTP/1.1Host: %sUser-Agent: %sKeep-Alive: 300Connection: keep-aliveContent-Length: 42$GET$Mozilla/4.0$POST
API String ID: 3318893083-109246470
Opcode ID: cf6dce72a8d604e4193ff0e49373804575b3d4ebc25db8e21539f0a00fb59f72
Instruction ID: e155546091234263bd9d973c1a068e587a5d4d2bce8d9a5a6c63011f5404cecd
Opcode Fuzzy Hash: cf6dce72a8d604e4193ff0e49373804575b3d4ebc25db8e21539f0a00fb59f72
Instruction Fuzzy Hash: BE213CB394026C6AC72AD7A5DC42FDA736C9FA8710F0002D6F308A61C1D6F0ABC48B61

Function 003D8270 Relevance: 19.8, APIs: 13, Instructions: 305COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 003D8292
GetTickCount.KERNEL32 ref: 003D82A8

Part of subcall function 003D81C0: WSAStartup.WS2_32(00000202,?), ref: 003D81E3

select.WS2_32(00000000,00000000,?,00000000,?), ref: 003D8314

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CountTick$Startupselect
String ID:
API String ID: 3882035529-0
Opcode ID: bbbf393a0ce9e7867f753e0a0be6096e767544ff1cc0112dc383b26e13626a15
Instruction ID: cb74252ced52cfcf20321cd10b7fac8ccb64b26d276e80b2b5e47e2c750a3848
Opcode Fuzzy Hash: bbbf393a0ce9e7867f753e0a0be6096e767544ff1cc0112dc383b26e13626a15
Instruction Fuzzy Hash: 44A1D8B2900604ABC735DF69E881AEBB3F9EF45310F00455FE69987341EB74BD858BA1

Function 003D6F70 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 125stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FE), ref: 003D6F91
lstrcpyA.KERNEL32(00000000,HKCU\), ref: 003D6FFE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000400), ref: 003D7017
_wcsnicmp.MSVCRT(?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,Software\Microsoft\Windows\CurrentVersion\Run), ref: 003D7061

Strings

%s.%s%s, xrefs: 003D70B0
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 003D7026, 003D704A, 003D705B
rreg, xrefs: 003D70AB
brk, xrefs: 003D707C, 003D709C
HKLM\, xrefs: 003D6FDE
%S%s%s, xrefs: 003D7077, 003D7097
HKCU\, xrefs: 003D6FF5

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ByteCharMultiWide_wcsnicmplstrcpymemset
String ID: %S%s%s$%s.%s%s$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
API String ID: 2911520168-3007424447
Opcode ID: 6e13b4f4884e5c4ba30915d86e5fb5ba8bbc9e1b9047c59211ed14095e876218
Instruction ID: 9ff99ca7312b98e578bb6d9290a9685462b5f6b13f88594a6a7efd1e7c8d5cf5
Opcode Fuzzy Hash: 6e13b4f4884e5c4ba30915d86e5fb5ba8bbc9e1b9047c59211ed14095e876218
Instruction Fuzzy Hash: D441A4B2A40218BBCB11DB95EC42EEE77BCEB58710F04025AF904E62C1F674D95087A5

Function 003DE880 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84pipestringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FF), ref: 003DE8A0
lstrlenA.KERNEL32(30e44aa1), ref: 003DE8AD
_snprintf.MSVCRT(00000000,00000400,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000), ref: 003DE8D0
CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 003DE8FF
ConnectNamedPipe.KERNEL32(00000000,00000000), ref: 003DE913
GetLastError.KERNEL32 ref: 003DE91D
CreateThread.KERNEL32(00000000,00000000,Function_0000D7A0,00000000,00000000,00000000), ref: 003DE941
CloseHandle.KERNEL32(00000000), ref: 003DE94B
CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,00000800,00000800,00001388,00000000), ref: 003DE96E

Strings

30e44aa1, xrefs: 003DE8A8, 003DE8B4
\\.\pipe\%08x_ipc, xrefs: 003DE8BF

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CreateNamedPipe$CloseConnectErrorHandleLastThread_snprintflstrlenmemset
String ID: 30e44aa1$\\.\pipe\%08x_ipc
API String ID: 4065143564-1096776489
Opcode ID: 659c0b8b4a7ef878524e7979d1f304078170696f029056138cd0a4609e981ea2
Instruction ID: 143eddb63e5bc85f432b57de9d5468973cd75d1d58dd70d0471fecf69cf9c3e3
Opcode Fuzzy Hash: 659c0b8b4a7ef878524e7979d1f304078170696f029056138cd0a4609e981ea2
Instruction Fuzzy Hash: 4F210272BC03257AF33266745C87FAA7A5CAB14F20F644761FB04FE1C0DAF069044AA8

Function 003D7100 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 102stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000206), ref: 003D7121
lstrcpyW.KERNEL32(?,HKCU\), ref: 003D7172
_wcsnicmp.MSVCRT(?,Software\Microsoft\Windows\CurrentVersion\Run,00000000,Software\Microsoft\Windows\CurrentVersion\Run), ref: 003D71A8

Strings

HKCU\, xrefs: 003D7166
%S%S%S, xrefs: 003D71C1, 003D71E4
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 003D717F, 003D7197, 003D71A2
HKLM\, xrefs: 003D714C
rreg, xrefs: 003D71FB
brk, xrefs: 003D71C6, 003D71E9
%s.%S%S, xrefs: 003D7200

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: _wcsnicmplstrcpymemset
String ID: %S%S%S$%s.%S%S$HKCU\$HKLM\$Software\Microsoft\Windows\CurrentVersion\Run$brk$rreg
API String ID: 1531173107-4065158899
Opcode ID: 6d801e1912f05fd69a2fb6e4f30cd94c3e4d3fc64c2177a69bdaedefdabd5b1f
Instruction ID: 2314ad9b4b568240370ebe02f0cccffb94680be584ab02e2ef2a175a7488fa9d
Opcode Fuzzy Hash: 6d801e1912f05fd69a2fb6e4f30cd94c3e4d3fc64c2177a69bdaedefdabd5b1f
Instruction Fuzzy Hash: 1C31F677A413647ACB12DE45AC86EEB337CEB98710F000756FD05A2282F6B0ED9086B5

Function 003D6940 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 72stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003D19F0: wcsrchr.MSVCRT(?,0000005C,?,003D6965,?,?,?), ref: 003D19F9

Part of subcall function 003D7700: memset.MSVCRT(?,00000000,000001FF), ref: 003D771E
Part of subcall function 003D7700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 003D7738
Part of subcall function 003D7700: lstrlenA.KERNEL32(00000000), ref: 003D7747

strstr.MSVCRT(003E6E90,.exe,?,?,?,?), ref: 003D69A8
lstrcmpA.KERNEL32(003E6D88,0041AC50,?,?,?,?,?,?), ref: 003D69BE
SetFileAttributesA.KERNEL32(003E6E90,00000080,?,?,?,?,?,?), ref: 003D69D2
DeleteFileA.KERNEL32(003E6E90,?,?,?,?,?,?), ref: 003D69DD
MoveFileExA.KERNEL32(003E6D88,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT),?,?,?,?,?,?), ref: 003D69EC

Part of subcall function 003DA310: memset.MSVCRT ref: 003DA335
Part of subcall function 003DA310: memset.MSVCRT ref: 003DA34F
Part of subcall function 003DA310: memset.MSVCRT(?,00000000,000003FF), ref: 003DA369
Part of subcall function 003DA310: _vsnprintf.MSVCRT(?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA382
Part of subcall function 003DA310: sprintf.MSVCRT(00000000,003E13EC,?,?,000003FE,003E0A8E,000001FE,?,00000000,000003FF), ref: 003DA39A
Part of subcall function 003DA310: lstrlenA.KERNEL32(30e44aa1,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s,blk,?,?,000001FE,003E0A8E), ref: 003DA3AD
Part of subcall function 003DA310: _snprintf.MSVCRT(?,000003FF,\\.\pipe\%08x_ipc,00000000,30e44aa1,00000000,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB,%s.%s), ref: 003DA3CC
Part of subcall function 003DA310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB,?,003D74EB), ref: 003DA3DB
Part of subcall function 003DA310: sprintf.MSVCRT(?,%d.,00000000,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000,756F59EB), ref: 003DA3EC
Part of subcall function 003DA310: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA3FB
Part of subcall function 003DA310: lstrlenA.KERNEL32(30e44aa1,?,?,?,?,?,?,?,?,?,?,?,00000000,000003FF,?,00000000), ref: 003DA404
Part of subcall function 003DA310: EnterCriticalSection.KERNEL32(0041AC34,?,?,00000000), ref: 003DA436
Part of subcall function 003DA310: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 003DA452
Part of subcall function 003DA310: LeaveCriticalSection.KERNEL32(0041AC34,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DA464

Strings

pdef, xrefs: 003D6986
.exe, xrefs: 003D699C
autorun.inf, xrefs: 003D6970
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!, xrefs: 003D6A06
%s.Blocked "%S" from creating "%S", xrefs: 003D6A24

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$Filememset$CriticalSection_snprintfsprintf$AttributesCreateDeleteEnterLeaveMove_vsnprintflstrcmpstrstrwcsrchr
String ID: %s.Blocked "%S" from creating "%S"$%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!$.exe$autorun.inf$pdef
API String ID: 2285763329-814828592
Opcode ID: e2030dddc11c317dfff728f730d4b57876c02e23b4e2f50e824d95959226057d
Instruction ID: c3958af0b9aca17592deeba6bf6c07debcaa09ba6a987e84bc23d056b579c5d6
Opcode Fuzzy Hash: e2030dddc11c317dfff728f730d4b57876c02e23b4e2f50e824d95959226057d
Instruction Fuzzy Hash: 2011CB7BBC03A032DA2326D63C47FDF32494BA1FA5F054226FD54F53C2DAA1E95041A2

Function 003D3C90 Relevance: 16.7, APIs: 11, Instructions: 227filepipeCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 003D3DA4
ReadFile.KERNEL32(?,-003E7960,00000800,00000000,?,?,?,00000000,000000FF), ref: 003D3DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 003D3E3E
ReadFile.KERNEL32(?,003E7960,00000800,00000000,?), ref: 003D3ED7
GetLastError.KERNEL32 ref: 003D3EE3
GetLastError.KERNEL32 ref: 003D3EEA
GetLastError.KERNEL32 ref: 003D3EF3
DisconnectNamedPipe.KERNEL32(?), ref: 003D3F68
ConnectNamedPipe.KERNEL32(?), ref: 003D3F7E

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ErrorLast$FileNamedPipeRead$ConnectDisconnectMultipleObjectsOverlappedResultWait
String ID:
API String ID: 4113577031-0
Opcode ID: 2edbaf7844ecdb1393fe1ea98fe36e80b8307205f877c132f39058dd0b12e1e6
Instruction ID: efd401a2cf9efd9dd044f2cd8b8d8ff8372752d231d4431fe7bb97ba6ea69f39
Opcode Fuzzy Hash: 2edbaf7844ecdb1393fe1ea98fe36e80b8307205f877c132f39058dd0b12e1e6
Instruction Fuzzy Hash: 3791C5B6A04219EFD715CF68E8C4FAA77A8FB49304F004269E505DB381D771EE51CBA2

Function 003D9080 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000206), ref: 003D90A0

Part of subcall function 003DA0F0: wcsrchr.MSVCRT(?,0000005C,?,?,003DA1D9,?,003D13BF,?,?,?,?,?,00000000,?,?,?), ref: 003DA0FA

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000208), ref: 003D9101

Strings

pif, xrefs: 003D9145
pdef, xrefs: 003D90D8
http, xrefs: 003D9172
scr, xrefs: 003D915D
com, xrefs: 003D912D
firefox.exe, xrefs: 003D90A5
%s.Blocked possible browser exploit pack call on URL '%s', xrefs: 003D9192
exe, xrefs: 003D9115
iexplore.exe, xrefs: 003D90BE

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ByteCharMultiWidememsetwcsrchr
String ID: %s.Blocked possible browser exploit pack call on URL '%s'$com$exe$firefox.exe$http$iexplore.exe$pdef$pif$scr
API String ID: 519477765-3787805686
Opcode ID: 2de8c3ede32502611203e857e64b1075490a1944d8842823a8f92be982084143
Instruction ID: 4ca16dc86c2892b484f9c7a72177be3e86febc7d1933405d8fdc49914063ff7f
Opcode Fuzzy Hash: 2de8c3ede32502611203e857e64b1075490a1944d8842823a8f92be982084143
Instruction Fuzzy Hash: 0131F4B6E403556BDF22DA51BC0AFEB376C9B10350F054657FC149A382EA71ED60C7A2

Function 003DB160 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 69stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(003D6E9C,00000000,00000000,00000000,?,?,003D6E9C), ref: 003DB178
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,003D6E9C), ref: 003DB186
lstrlenA.KERNEL32(003D6E9C,?,?,003D6E9C), ref: 003DB18F
strstr.MSVCRT(00000000,,00000000,003D6E9C,00000000,?,?,003D6E9C), ref: 003DB19F
strstr.MSVCRT(-00000004,003E19DC,?,?,?,003D6E9C), ref: 003DB1B6
lstrlenA.KERNEL32(-00000004,?,?,?,?,?,003D6E9C), ref: 003DB1C3
HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,003D6E9C), ref: 003DB1D2
lstrlenA.KERNEL32(-00000004,?,?,?,?,?,003D6E9C), ref: 003DB1DC
lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,003D6E9C), ref: 003DB1E5
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,003D6E9C), ref: 003DB1F8

Strings

, xrefs: 003DB199

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$Heap$Allocstrstr$Freelstrcpyn
String ID:
API String ID: 1314289781-2344752452
Opcode ID: 5aa0ff57d6fe46b096632792f5a0ed9b5515c6a37e2db427a6458201d3eb1f67
Instruction ID: fbeb5a47e911f541656ddf0a57f798140b687dd9417f9ff34d287545a7c58110
Opcode Fuzzy Hash: 5aa0ff57d6fe46b096632792f5a0ed9b5515c6a37e2db427a6458201d3eb1f67
Instruction Fuzzy Hash: 81117373A01354BBD721ABA69C85FEB77ACEF45711F014115FA04E7391DAB4EE0087A0

Function 003DAC00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82memorynetworkstringCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 003DAC1A
HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 003DAC3E
GetLastError.KERNEL32 ref: 003DAC44
HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 003DAC5E
HttpQueryInfoW.WININET(?,8000002D,00000000,?,?), ref: 003DAC79
lstrcmpW.KERNEL32(POST,00000000), ref: 003DAC85
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DAC99
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DACB2

Strings

POST, xrefs: 003DAC80

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heap$AllocFreeHttpInfoQuery$ErrorLastlstrcmp
String ID: POST
API String ID: 770645459-1814004025
Opcode ID: 9f32966a84bc3067a9cee64dbdb1bd6b12d7d86d74a2374e3787de0cacefdc9c
Instruction ID: a268d30b40438a05b09b9f0d5229074b0a280b4f4c47bd6ddb00dedfcf023351
Opcode Fuzzy Hash: 9f32966a84bc3067a9cee64dbdb1bd6b12d7d86d74a2374e3787de0cacefdc9c
Instruction Fuzzy Hash: D2219376611614BBD7329BA5AD88EFF7B7CEB85761F104259FA04D7280D6309D00C7A1

Function 003DA690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79processCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000206), ref: 003DA6AF
memset.MSVCRT(?,00000000,00000616,?,00000000,00000206), ref: 003DA6CA
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000000), ref: 003DA6DF
PathAppendW.SHLWAPI(?,Internet Explorer\iexplore.exe), ref: 003DA6F9
_snwprintf.MSVCRT(?,00000617,"%s" %S,?,?), ref: 003DA71B
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?), ref: 003DA77F

Strings

D, xrefs: 003DA741
Internet Explorer\iexplore.exe, xrefs: 003DA6ED
"%s" %S, xrefs: 003DA70A

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Pathmemset$AppendCreateFolderProcessSpecial_snwprintf
String ID: "%s" %S$D$Internet Explorer\iexplore.exe
API String ID: 1165436438-694066683
Opcode ID: 77819245ca30d7a5291dc6bd017cb7e55881aadd794e0b612f742fd5ecffdcb8
Instruction ID: 0e1beb13de400c3eb8a6067eadd20a839d72454f3c45ae41791e02d85d31753d
Opcode Fuzzy Hash: 77819245ca30d7a5291dc6bd017cb7e55881aadd794e0b612f742fd5ecffdcb8
Instruction Fuzzy Hash: 8821BB71940308BAEB21DBE0DC46FEE7378AF44B00F144685F6096E1C0EBF19E448B99

Function 003D9430 Relevance: 15.1, APIs: 10, Instructions: 109networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003D9300: inet_addr.WS2_32(n"=), ref: 003D9308
Part of subcall function 003D9300: gethostbyname.WS2_32(n"=), ref: 003D9313

GetTickCount.KERNEL32 ref: 003D9467
htons.WS2_32(?), ref: 003D9490
GetTickCount.KERNEL32(?), ref: 003D94BD
GetTickCount.KERNEL32 ref: 003D94C1
socket.WS2_32(00000002,00000002,00000011), ref: 003D94F6
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 003D9511
sendto.WS2_32(?,?,00001964,00000000,00000002,00000010), ref: 003D953C
Sleep.KERNEL32(00000064,00000002,00000002,00000011), ref: 003D9549
closesocket.WS2_32(?), ref: 003D9559
GetTickCount.KERNEL32(?), ref: 003D9564

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CountTick$Sleepclosesocketgethostbynamehtonsinet_addrioctlsocketsendtosocket
String ID:
API String ID: 2400900511-0
Opcode ID: 3d54589e553061f67ed33b157dc459d3801781e68a48489d56a9ebf71df76441
Instruction ID: 85e521eea913e2dae0f855e9555ea0f0194ed33284f2adc0836125a5d54e35c9
Opcode Fuzzy Hash: 3d54589e553061f67ed33b157dc459d3801781e68a48489d56a9ebf71df76441
Instruction Fuzzy Hash: 52313A739001745BD722EBF9A846BAEB2A99F85304F020633F905EB3C1C5B08D0187A2

Function 003DACD0 Relevance: 15.1, APIs: 10, Instructions: 107memorynetworkstringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103,?,00000000,?), ref: 003DACF5
HeapAlloc.KERNEL32(?,00000008,00000000,?,00000000,?), ref: 003DAD0A
InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 003DAD2B
GetLastError.KERNEL32 ref: 003DAD31
HeapReAlloc.KERNEL32(?,00000008,00000000,?), ref: 003DAD4F
InternetQueryOptionW.WININET(?,00000022,00000000,?), ref: 003DAD63
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000104,00000000,00000000), ref: 003DAD80
??2@YAPAXI@Z.MSVCRT(00000000), ref: 003DAD93
lstrcpyA.KERNEL32(?,00000000), ref: 003DADB3
HeapFree.KERNEL32(?,00000000,00000000), ref: 003DADE6

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heap$AllocInternetOptionQuery$??2@ByteCharErrorFreeLastMultiWidelstrcpymemset
String ID:
API String ID: 3155763378-0
Opcode ID: df8065c42b128f2fd9b96521b34f86d1f4ce45ae0236ff98a70b007096d37a7f
Instruction ID: 3dbc74ab238b4b08913de771d38ee90e81bdf1d9b93d66b54c7c1ad8f77c744b
Opcode Fuzzy Hash: df8065c42b128f2fd9b96521b34f86d1f4ce45ae0236ff98a70b007096d37a7f
Instruction Fuzzy Hash: 9731AF75500354BBD7229B95DC85FAA7BBCEB8A711F104245FA049B2C0D7B09E40CBA1

Function 003D9330 Relevance: 15.1, APIs: 10, Instructions: 81networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003D9300: inet_addr.WS2_32(n"=), ref: 003D9308
Part of subcall function 003D9300: gethostbyname.WS2_32(n"=), ref: 003D9313

htons.WS2_32(?), ref: 003D935D
GetTickCount.KERNEL32(?), ref: 003D936F
GetTickCount.KERNEL32 ref: 003D9373
socket.WS2_32(00000002,00000001,00000000), ref: 003D93A6
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 003D93C1
connect.WS2_32(?,?,00000010), ref: 003D93DE
Sleep.KERNEL32(00000064,?,?,00000010,00000002,00000001,00000000), ref: 003D93EB
closesocket.WS2_32(?), ref: 003D93F8
Sleep.KERNEL32(0000004B,?), ref: 003D9405
GetTickCount.KERNEL32 ref: 003D9407

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CountTick$Sleep$closesocketconnectgethostbynamehtonsinet_addrioctlsocketsocket
String ID:
API String ID: 1090714710-0
Opcode ID: b2b0ca089be2a68618063d439e3dcc4854f75b49a776f0f8fec6807d43d2bf8a
Instruction ID: 0ad26b93ee245691003d0d805d80739b538ba71f3f4b9ef6a6d5f765b8096007
Opcode Fuzzy Hash: b2b0ca089be2a68618063d439e3dcc4854f75b49a776f0f8fec6807d43d2bf8a
Instruction Fuzzy Hash: 8021C7739002256BD721FBB9AD85B9EB3699B84310F124727E918FB2C1D6B09D41CBD1

Function 003DFC90 Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 57stringsleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003DFCB0
lstrlenA.KERNEL32(30e44aa1), ref: 003DFCBD
_snprintf.MSVCRT(?,00000103,%0x.exe,00000000,30e44aa1,00000000), ref: 003DFCE0
lstrcpyW.KERNEL32(0041B9A0,0041ADA0), ref: 003DFCF2
lstrcpyA.KERNEL32(0041BDB0,RECYCLED), ref: 003DFD08
lstrcpyA.KERNEL32(0041BEB4,?), ref: 003DFD16

Part of subcall function 003DF9E0: memset.MSVCRT(?,00000000,000001FF), ref: 003DF9FF
Part of subcall function 003DF9E0: GetLogicalDriveStringsA.KERNEL32(000001FF,00000000), ref: 003DFA22
Part of subcall function 003DF9E0: lstrcatA.KERNEL32(00000000,003E3040), ref: 003DFA5C

Sleep.KERNEL32(00003A98), ref: 003DFD61

Strings

%0x.exe, xrefs: 003DFCCF
30e44aa1, xrefs: 003DFCB8, 003DFCC4
RECYCLED, xrefs: 003DFCFE

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrcpy$memset$DriveLogicalSleepStrings_snprintflstrcatlstrlen
String ID: %0x.exe$30e44aa1$RECYCLED
API String ID: 530497602-684435549
Opcode ID: 8473c6f7b583ab1595af5186c6203a0ea12624af75930793b82b7fbeddf7aa76
Instruction ID: 2f2fb493441fef0c949bbf23f97d5de1d68e114ccf96c13f022fe4325255511b
Opcode Fuzzy Hash: 8473c6f7b583ab1595af5186c6203a0ea12624af75930793b82b7fbeddf7aa76
Instruction Fuzzy Hash: 3A11C4B2940368AFD312AB65ACC2FD5776CE708704F40817BF644962D2C7F419C18FA9

Function 003D5820 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 171sleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000007FF,?,(m>), ref: 003D5844
CloseHandle.KERNEL32(00000000), ref: 003D58B9
InterlockedCompareExchange.KERNEL32(00000000,00000000), ref: 003D5970
CloseHandle.KERNEL32(00000000), ref: 003D5A05

Part of subcall function 003D49F0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,003D73CC,00407C98,00000000,00000000,00000010,00000000), ref: 003D4A10
Part of subcall function 003D49F0: ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 003D4A77

Sleep.KERNEL32(00000001), ref: 003D59F9

Strings

(m>, xrefs: 003D582A
.`=, xrefs: 003D59A7, 003D59AC
STFU, xrefs: 003D5933, 003D5936

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CloseHandle$CompareExchangeInterlockedMutexObjectReleaseSingleSleepWaitmemset
String ID: (m>$.`=$STFU
API String ID: 1355865062-3008306076
Opcode ID: a1f39f6ac65c7e1a5b46391033606b31ec23884574eb49eadbf0e14a4f893803
Instruction ID: 312805df64010eafdb2e6a8308335d85996aed8fd038ceb2750016e659d1e37f
Opcode Fuzzy Hash: a1f39f6ac65c7e1a5b46391033606b31ec23884574eb49eadbf0e14a4f893803
Instruction Fuzzy Hash: 22519371E00215ABDB25DFA8DC45BAE77B8EB84710F14816AF945EB381EB749E40CB90

Function 003D89B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000034), ref: 003D89C5
AcquireCredentialsHandleW.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 003D8A32
QueryContextAttributesW.SECUR32(?,00000004,00000001), ref: 003D8AC3
InitializeSecurityContextW.SECUR32(?,00000000,?,0008C11C,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 003D8A79

Part of subcall function 003D8760: FreeContextBuffer.SECUR32(?), ref: 003D8774

Part of subcall function 003D8790: InitializeSecurityContextW.SECUR32(?,?,?,0008C11C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 003D88AE

DeleteSecurityContext.SECUR32(?), ref: 003D8B17
FreeCredentialsHandle.SECUR32(?), ref: 003D8B1E

Strings

Microsoft Unified Security Protocol Provider, xrefs: 003D89E0
, xrefs: 003D8A14

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Context$Security$CredentialsFreeHandleInitialize$AcquireAttributesBufferDeleteQuerymemset
String ID: $Microsoft Unified Security Protocol Provider
API String ID: 3657786480-3891800672
Opcode ID: 00c07836cfea5094ea8f008ac63d367220df0194460e2728b98c946303383afa
Instruction ID: 8eefa13b26e6ae1f5f4339d88a06a9ac91e84c930739e8ad9e27283476182318
Opcode Fuzzy Hash: 00c07836cfea5094ea8f008ac63d367220df0194460e2728b98c946303383afa
Instruction Fuzzy Hash: 67511BB2D00248AFDB21DF9ADC859AFFBFCFF94700F10451AE515EA251E774AA058B60

Function 003D1D10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FE), ref: 003D1D31
memset.MSVCRT(?,00000000,000001FF,?,00000000,000003FE), ref: 003D1D4B
lstrcmpA.KERNEL32(00000000,block), ref: 003D1D9B
strstr.MSVCRT(00000000,003E13D8), ref: 003D1DAB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000400), ref: 003D1DCA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000200,00000000,00000000), ref: 003D1E0C

Strings

block, xrefs: 003D1D95
bdns, xrefs: 003D1D6E, 003D1E29

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ByteCharMultiWidememset$lstrcmpstrstr
String ID: bdns$block
API String ID: 1883446694-4143068083
Opcode ID: 96b0f9833b23568945f283e8d0d7d761f3155d274345234c36a1fd79abd4dd50
Instruction ID: d0c21aba3603271d3a88b52f30a1cbb60828cccb2971150786c0e6f21532859d
Opcode Fuzzy Hash: 96b0f9833b23568945f283e8d0d7d761f3155d274345234c36a1fd79abd4dd50
Instruction Fuzzy Hash: DA31F6B66403547BD732DA55AC46FFB737DDF84711F00425AFE14AA2C1EBB09A10C6A1

Function 003D1000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(?,0041AC50), ref: 003D100D
lstrcmpA.KERNEL32(?,0041AA28), ref: 003D1054
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 003D1062
lstrcpyA.KERNEL32(003E6D88,?), ref: 003D108B
lstrcpyA.KERNEL32(003E6E90,?), ref: 003D1093

Part of subcall function 003D7700: memset.MSVCRT(?,00000000,000001FF), ref: 003D771E
Part of subcall function 003D7700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 003D7738
Part of subcall function 003D7700: lstrlenA.KERNEL32(00000000), ref: 003D7747

Strings

pdef, xrefs: 003D1017
ruskill, xrefs: 003D106D
%s.%s, xrefs: 003D1072

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrcmplstrcpy$FileMove_snprintflstrlenmemset
String ID: %s.%s$pdef$ruskill
API String ID: 4105673886-2574534833
Opcode ID: 04ebf2ac60e6c9650553d5f981466777b780c5a7806725296773c8068a19d348
Instruction ID: 231f158da22b1fc199dac8292a2c198f3243c52055c55416a5196d3938902b51
Opcode Fuzzy Hash: 04ebf2ac60e6c9650553d5f981466777b780c5a7806725296773c8068a19d348
Instruction Fuzzy Hash: A201F537340290B7C33367AABC86EEBB79CDF687A0B040116F608D5281D670D890C2B5

Function 003D9C60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 81stringmemoryCOMMON

Download Yara Rule

APIs

strtok.MSVCRT(?,003E29EC), ref: 003D9C7C
HeapFree.KERNEL32(?,00000000,?), ref: 003D9C9A
lstrcpyA.KERNEL32(0041B648,003E1335), ref: 003D9CB3
lstrcpynA.KERNEL32(0041B648,00000000,00000200), ref: 003D9CC4
strtok.MSVCRT(00000000,003E29EC), ref: 003D9CDB
atoi.MSVCRT(00000000), ref: 003D9CE8
HeapFree.KERNEL32(?,00000000,?), ref: 003D9D73

Strings

[Slowloris]: Starting flood on "%s" for %d minute(s), xrefs: 003D9CF9
[Slowloris]: Finished flood on "%s", xrefs: 003D9D45

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: FreeHeapstrtok$atoilstrcpylstrcpyn
String ID: [Slowloris]: Finished flood on "%s"$[Slowloris]: Starting flood on "%s" for %d minute(s)
API String ID: 1726920797-1250431664
Opcode ID: 3f05cb43d14f2d3ebebb4978213ddc58f23265044b6fb651df73ae71fde8d0c0
Instruction ID: c265bde9434f26a13b1d3c8deae880ce6b0363c94b9df03b9186a70947223869
Opcode Fuzzy Hash: 3f05cb43d14f2d3ebebb4978213ddc58f23265044b6fb651df73ae71fde8d0c0
Instruction Fuzzy Hash: A02126732407946BD322ABE1FC86FEB379CE754705F10422AF6049A2D1C7B45850CBE5

Function 003E0BB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMON

Download Yara Rule

APIs

_stricmp.MSVCRT(?,GetAddrInfoW), ref: 003E0C14
_stricmp.MSVCRT(?,send), ref: 003E0C26

Strings

wininet.dll, xrefs: 003E0BE7
GetAddrInfoW, xrefs: 003E0C0E
dnsapi.dll, xrefs: 003E0BF9
nspr4.dll, xrefs: 003E0BD5
send, xrefs: 003E0C20

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: _stricmp
String ID: GetAddrInfoW$dnsapi.dll$nspr4.dll$send$wininet.dll
API String ID: 2884411883-3553644081
Opcode ID: 790f4b91fc9e9870806336c6398cf65237da3ccbdf481761b9d02a1dc27a5c9e
Instruction ID: 0f46f3d7070fe08e02f99f04fb2a3d4fdc4077aaa073616686eecfaefdf34ad0
Opcode Fuzzy Hash: 790f4b91fc9e9870806336c6398cf65237da3ccbdf481761b9d02a1dc27a5c9e
Instruction Fuzzy Hash: EF11C833F401B1519A2B52A77D02BEAA24C5B60762F060333FD0DDB3C1D5D1DAD081E2

Function 003DC8C6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,http.set,?,msn.int,?,003E57F4,?,003E57F0,?,speed,?,rs0,?,stats), ref: 003DC8DD
lstrlenA.KERNEL32(?,?,http.set,?,msn.int,?,003E57F4,?,003E57F0,?,speed,?,rs0,?,stats), ref: 003DC8E5
lstrcatA.KERNEL32(00000000,003E2C78,?,?,http.set,?,msn.int,?,003E57F4,?,003E57F0,?,speed,?,rs0), ref: 003DC907
lstrcatA.KERNEL32(00000000,?,?,?,http.set,?,msn.int,?,003E57F4,?,003E57F0,?,speed,?,rs0), ref: 003DC913
lstrcmpA.KERNEL32(00000000,http.int,?,http.set,?,msn.int,?,003E57F4,?,003E57F0,?,speed,?,rs0,?,stats), ref: 003DC985
atoi.MSVCRT(?,?,?,http.set,?,msn.int,?,003E57F4,?,003E57F0,?,speed,?,rs0,?,stats), ref: 003DC99C
atoi.MSVCRT(00000000), ref: 003DC9AF

Strings

[HTTP]: Updated HTTP spread message to "%s", xrefs: 003DC972
msg, xrefs: 003DC94A
http, xrefs: 003DC955

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: atoilstrcatlstrlen$lstrcmp
String ID: [HTTP]: Updated HTTP spread message to "%s"$http$msg
API String ID: 3861295430-3390247340
Opcode ID: b7cd8053e5152b442a70fed171692eb84d917e28c14c215736d3d590cab9e541
Instruction ID: 47e5ce13cc79fc499c87766042594b9f7a029b9f5f264c853ff8d4aa523b7b3b
Opcode Fuzzy Hash: b7cd8053e5152b442a70fed171692eb84d917e28c14c215736d3d590cab9e541
Instruction Fuzzy Hash: 8801C47691025D9EDB22DB60DC81EDBB37CAF44300F11058AE44997182DB70FA86CF61

Function 003D3DB8 Relevance: 12.1, APIs: 8, Instructions: 108fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,-003E7960,00000800,00000000,?,?,?,00000000,000000FF), ref: 003D3DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 003D3E3E
ReadFile.KERNEL32(?,003E7960,00000800,00000000,?), ref: 003D3ED7
GetLastError.KERNEL32 ref: 003D3EE3
GetLastError.KERNEL32 ref: 003D3EEA
GetLastError.KERNEL32 ref: 003D3EF3
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 003D3F0D
GetLastError.KERNEL32(?,?,00000000,000000FF), ref: 003D3F1D

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
String ID:
API String ID: 146293752-0
Opcode ID: 7dbdf45d5aaf146afbb0b1167dbfff8a1835e50c413952c15d5aca8ac7e10598
Instruction ID: 1fa9a656c4461f8fecb4723fdf920a5bf4a1d913cf5498310075ea994c1d480e
Opcode Fuzzy Hash: 7dbdf45d5aaf146afbb0b1167dbfff8a1835e50c413952c15d5aca8ac7e10598
Instruction Fuzzy Hash: E5418DB6604219EFD711CF68E8C4FAA77A8FF49304F408658E5469B385C731EE51CBA2

Function 003D3DB6 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,-003E7960,00000800,00000000,?,?,?,00000000,000000FF), ref: 003D3DFF
GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 003D3E3E
ReadFile.KERNEL32(?,003E7960,00000800,00000000,?), ref: 003D3ED7
GetLastError.KERNEL32 ref: 003D3EE3
GetLastError.KERNEL32 ref: 003D3EEA
GetLastError.KERNEL32 ref: 003D3EF3
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 003D3F0D
GetLastError.KERNEL32(?,?,00000000,000000FF), ref: 003D3F1D

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ErrorLast$FileRead$MultipleObjectsOverlappedResultWait
String ID:
API String ID: 146293752-0
Opcode ID: f98f24b07ae05d0e29b8a5bd9e05061e2d64751cc6deab154d9319fb8d854e7a
Instruction ID: 4fe6dabab8b0a800b8b411b691b0cede5d2012e179bf3dcaafc7c74de2e0a282
Opcode Fuzzy Hash: f98f24b07ae05d0e29b8a5bd9e05061e2d64751cc6deab154d9319fb8d854e7a
Instruction Fuzzy Hash: D3419DB6604219AFD711CF68E8C4FAA77A8FF49304F408658E5069B381C731EE01CBA2

Function 003D7500 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 003D752B
_snprintf.MSVCRT(?,000001FF,%s_,?), ref: 003D7547
_vsnprintf.MSVCRT(?,000001FF,00000000,?), ref: 003D7569
lstrcmpA.KERNEL32(?,bdns), ref: 003D758B
StrStrIA.SHLWAPI(?,00000000), ref: 003D759F
lstrlenA.KERNEL32(?), ref: 003D75B9

Strings

%s_, xrefs: 003D7536
bdns, xrefs: 003D7585

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$_snprintf_vsnprintflstrcmp
String ID: %s_$bdns
API String ID: 3897371274-741241040
Opcode ID: 726638a4f028c6ba6f7936c4ead4811d6733c4fe72510fbdea1a5c505a67353c
Instruction ID: 811a997c4f99f12f1588b30ab6376034f2db93121b1abe16afbb04e2c56fb9c5
Opcode Fuzzy Hash: 726638a4f028c6ba6f7936c4ead4811d6733c4fe72510fbdea1a5c505a67353c
Instruction Fuzzy Hash: 8321F6736042256BDB229E69BCC9FEBB75CEB45750F04066AFD09D7281FA70DE0086E1

Function 003D8670 Relevance: 12.1, APIs: 8, Instructions: 70networkmemorythreadCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000103C), ref: 003D8688
htons.WS2_32(?), ref: 003D86AE
inet_ntoa.WS2_32(?), ref: 003D86F7
htons.WS2_32(?), ref: 003D8704
GetTickCount.KERNEL32 ref: 003D8713
CreateThread.KERNEL32(00000000,00000000,003D8640,00000000,00000000,00000000), ref: 003D8734
CloseHandle.KERNEL32(00000000), ref: 003D873B

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: htons$AllocCloseCountCreateHandleLocalThreadTickinet_ntoa
String ID:
API String ID: 30336511-0
Opcode ID: af12c214352e10b6538f221c1e0159bf503b42256e46f0ec42b0049817f4e98a
Instruction ID: 51ce0e87f36cb32933fdc6b0470ac3a89e3a90fa5e488efc42ef44af56d270e5
Opcode Fuzzy Hash: af12c214352e10b6538f221c1e0159bf503b42256e46f0ec42b0049817f4e98a
Instruction Fuzzy Hash: 3F212B7560174097D3225BB4FC4A7EA77A8AF04310F144A2AF59D8B3D0DBF0A5848B59

Function 003D7790 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,00000103), ref: 003D77AE
memset.MSVCRT(?,00000000,000001FF,?,00000000,00000103), ref: 003D77C8
lstrcpyA.KERNEL32(00000000,off), ref: 003D77F0
_snprintf.MSVCRT(00000000,000001FF,state_%s,?), ref: 003D780D
lstrlenA.KERNEL32(00000000), ref: 003D7822
lstrlenA.KERNEL32(00000000), ref: 003D7858

Strings

off, xrefs: 003D77E4
state_%s, xrefs: 003D77FC

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlenmemset$_snprintflstrcpy
String ID: off$state_%s
API String ID: 1009457118-628336787
Opcode ID: c58a2284145792037302e4825a14ceb9efdd0f4ac73b6e8fab3f2b352600a043
Instruction ID: 92e4799965af19d95a97f8d053ad596c3340455020d04244051422044a56e440
Opcode Fuzzy Hash: c58a2284145792037302e4825a14ceb9efdd0f4ac73b6e8fab3f2b352600a043
Instruction Fuzzy Hash: F91133B694136877D722E651DC46FEF337C8B84700F0002E9FB486A1C2E6F02B848AA1

Function 003D3440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

printf.MSVCRT(block_size: %d,?,00407A80,?), ref: 003D34A0
printf.MSVCRT(ngr->blocksize: %d,?,block_size: %d,?,00407A80,?), ref: 003D34AD
printf.MSVCRT(Done frst,?,?,?,?,00407A80,?), ref: 003D34CC

Strings

block_size: %d, xrefs: 003D3498
ngr->blocksize: %d, xrefs: 003D34A8
Done frst, xrefs: 003D34C7

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: printf
String ID: Done frst$block_size: %d$ngr->blocksize: %d
API String ID: 3524737521-1816125109
Opcode ID: 409b0083087d7c189a890ef92a4eb55af9b5fa2f7869c1f4943bc78cbec9bc57
Instruction ID: d8348b0a48bcf4153e2e422b9b27adce15ae64e4305fe7c675b2ff77673fc277
Opcode Fuzzy Hash: 409b0083087d7c189a890ef92a4eb55af9b5fa2f7869c1f4943bc78cbec9bc57
Instruction Fuzzy Hash: 8641E7B6A00204ABCB15DF69E845E9A77A9EF84314F14C65EF8098B381E731EF01CB91

Function 003D2A30 Relevance: 10.6, APIs: 7, Instructions: 131networksleepCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 003D2A44

Part of subcall function 003D2460: GetProcessHeap.KERNEL32(?,003D20DE,?), ref: 003D246C
Part of subcall function 003D2460: HeapAlloc.KERNEL32(?,00000008,003D20DE,?,003D20DE,?), ref: 003D247E

socket.WS2_32(00000002,00000001,00000006), ref: 003D2A8A
WSAGetLastError.WS2_32(00000002,00000001,00000006), ref: 003D2A96
GetLastError.KERNEL32(00000002,00000001,00000006), ref: 003D2A9B

Part of subcall function 003D24A0: GetProcessHeap.KERNEL32(00000000,?,003D2131,00000000), ref: 003D24B4
Part of subcall function 003D24A0: HeapFree.KERNEL32(?,00000000,1!=,00000000,?,003D2131,00000000), ref: 003D24C3

inet_ntoa.WS2_32(00000002), ref: 003D2AEE
connect.WS2_32(00000000,?,00000010), ref: 003D2AFC
Sleep.KERNEL32(000005DC,00000000,?,00000010,00000001,00000006), ref: 003D2B0B

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocFreeSleepconnecthtonsinet_ntoasocket
String ID:
API String ID: 268164981-0
Opcode ID: 9bde5acb8af36243b5af01ecac1e01bb78957b5b1a7064ca6c6f413058b22165
Instruction ID: 9847c3193035cafeb3b631aa02bcd00f8281856ed319ef1cca363af67ee65841
Opcode Fuzzy Hash: 9bde5acb8af36243b5af01ecac1e01bb78957b5b1a7064ca6c6f413058b22165
Instruction Fuzzy Hash: CC411772E002149BCB22EFA9E881A6FB3B9FF54324F104667E959DF380D6719941CBC1

Function 003D7F90 Relevance: 10.6, APIs: 7, Instructions: 131networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000000,?,00000000,?), ref: 003D7FD4
send.WS2_32(?,?,?,00000000), ref: 003D7FFB
LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,00000000,?), ref: 003D8004
select.WS2_32(00000000,00000000,00000000,00000001,?), ref: 003D803D
select.WS2_32(00000000,?,00000000,00000000,?), ref: 003D8081
recv.WS2_32(?,?,00001000,00000000), ref: 003D809A

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: select$FreeLocalrecvsend
String ID:
API String ID: 1822081929-0
Opcode ID: 346268592867af884d1ec6f78dc87a983da32c04590c78595c975192d30af863
Instruction ID: 5d52aa98b90b997aba3639d25935eea7cd0c69996008af9f1129a567a708c8c4
Opcode Fuzzy Hash: 346268592867af884d1ec6f78dc87a983da32c04590c78595c975192d30af863
Instruction Fuzzy Hash: F2418172500754ABD730DB69DC81BE6B3F8EB98710F00469EF5898B680D7F5B9C98B90

Function 003D6E20 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 126memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 003D2460: GetProcessHeap.KERNEL32(?,003D20DE,?), ref: 003D246C
Part of subcall function 003D2460: HeapAlloc.KERNEL32(?,00000008,003D20DE,?,003D20DE,?), ref: 003D247E

Part of subcall function 003DAFA0: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 003DAFBD
Part of subcall function 003DAFA0: HeapAlloc.KERNEL32(?,00000008,-00000002), ref: 003DAFCB
Part of subcall function 003DAFA0: memset.MSVCRT(?,00000000,000003FF), ref: 003DAFE8
Part of subcall function 003DAFA0: memset.MSVCRT(?,00000000,000003FF,?,00000000,000003FF), ref: 003DB002
Part of subcall function 003DAFA0: lstrlenA.KERNEL32(?), ref: 003DB013
Part of subcall function 003DAFA0: sscanf.MSVCRT(00000000,POST /%1023s,00000000,00000000,?,00000000), ref: 003DB02A
Part of subcall function 003DAFA0: strtok.MSVCRT(00000000,003E2B84), ref: 003DB041
Part of subcall function 003DAFA0: _memicmp.MSVCRT(00000000,Host: ,00000006), ref: 003DB05B
Part of subcall function 003DAFA0: strtok.MSVCRT(00000000,003E2B84), ref: 003DB06E
Part of subcall function 003DAFA0: lstrlenA.KERNEL32(00000000), ref: 003DB09B
Part of subcall function 003DAFA0: lstrlenA.KERNEL32(00000000), ref: 003DB0AD
Part of subcall function 003DAFA0: lstrlenA.KERNEL32(00000000), ref: 003DB0BB
Part of subcall function 003DAFA0: lstrlenA.KERNEL32(00000000), ref: 003DB0C6
Part of subcall function 003DAFA0: HeapAlloc.KERNEL32(?,00000000,?), ref: 003DB0D5
Part of subcall function 003DAFA0: _memicmp.MSVCRT(00000000,HTTP,00000004), ref: 003DB0EB

strstr.MSVCRT(00000000,003E19DC,?,?,?,?), ref: 003D6EBC
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?), ref: 003D6EC9
lstrlenA.KERNEL32(?,?,?,?,?), ref: 003D6EE7
HeapFree.KERNEL32(?,00000000,00000000,?,?), ref: 003D6F1A
HeapFree.KERNEL32(?,00000000,?,?,?), ref: 003D6F2C
HeapFree.KERNEL32(?,00000000,00000000,?,?), ref: 003D6F3C

Part of subcall function 003DB160: lstrlenA.KERNEL32(003D6E9C,00000000,00000000,00000000,?,?,003D6E9C), ref: 003DB178
Part of subcall function 003DB160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,003D6E9C), ref: 003DB186
Part of subcall function 003DB160: lstrlenA.KERNEL32(003D6E9C,?,?,003D6E9C), ref: 003DB18F
Part of subcall function 003DB160: strstr.MSVCRT(00000000,,00000000,003D6E9C,00000000,?,?,003D6E9C), ref: 003DB19F
Part of subcall function 003DB160: strstr.MSVCRT(-00000004,003E19DC,?,?,?,003D6E9C), ref: 003DB1B6
Part of subcall function 003DB160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,003D6E9C), ref: 003DB1C3
Part of subcall function 003DB160: HeapAlloc.KERNEL32(?,00000008,-00000002,?,?,?,?,?,003D6E9C), ref: 003DB1D2
Part of subcall function 003DB160: lstrlenA.KERNEL32(-00000004,?,?,?,?,?,003D6E9C), ref: 003DB1DC
Part of subcall function 003DB160: lstrcpynA.KERNEL32(00000000,-00000004,00000001,?,?,?,?,?,003D6E9C), ref: 003DB1E5
Part of subcall function 003DB160: HeapFree.KERNEL32(?,00000000,00000000,?,?,?,003D6E9C), ref: 003DB1F8

Part of subcall function 003E01E0: memset.MSVCRT(?,00000000,000001FF,00000000,00000000,00000000), ref: 003E0202
Part of subcall function 003E01E0: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 003E0213
Part of subcall function 003E01E0: EnterCriticalSection.KERNEL32(0041B4E4), ref: 003E0223
Part of subcall function 003E01E0: strstr.MSVCRT(00000000,003E19DC), ref: 003E0243
Part of subcall function 003E01E0: lstrlenA.KERNEL32(00000000), ref: 003E0254
Part of subcall function 003E01E0: HeapAlloc.KERNEL32(00000000,00000008,00000001), ref: 003E025F
Part of subcall function 003E01E0: lstrcpyA.KERNEL32(00000000,00000000), ref: 003E0272
Part of subcall function 003E01E0: strstr.MSVCRT(00000000,), ref: 003E0281
Part of subcall function 003E01E0: _snprintf.MSVCRT(00000000,000001FF,%s=,003E32E4), ref: 003E02C8
Part of subcall function 003E01E0: strstr.MSVCRT(?,00000000), ref: 003E02EF
Part of subcall function 003E01E0: HeapFree.KERNEL32(?,00000000,00000000), ref: 003E03E4

Strings

POST, xrefs: 003D6E5A

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heaplstrlen$Allocstrstr$Free$memset$Process_memicmpstrtok$CriticalEnterSection_snprintflstrcpylstrcpynsscanf
String ID: POST
API String ID: 836748388-1814004025
Opcode ID: 6cffed90115b803e4864d878469acf2efbdf8d554fd39e4f5d92a4e99fb107d7
Instruction ID: 63f0ae21f64fb225f9e41665d6670f6d936ba1d1c2a59830f0aebc9861772fe6
Opcode Fuzzy Hash: 6cffed90115b803e4864d878469acf2efbdf8d554fd39e4f5d92a4e99fb107d7
Instruction Fuzzy Hash: AC31B576900204ABCB129FA5FC86EAF77BCEB84300F15417AF91897341DA75EE1487A2

Function 003DD110 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 98stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF), ref: 003DD131
lstrcmpA.KERNEL32(?,332), ref: 003DD145
strchr.MSVCRT(?,00000021), ref: 003DD162
lstrcpynA.KERNEL32(00000000,?,000001FF), ref: 003DD18C
lstrlenA.KERNEL32 ref: 003DD198
memmove.MSVCRT(?,?,00000000), ref: 003DD1A4

Strings

332, xrefs: 003DD13F

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrcmplstrcpynlstrlenmemmovememsetstrchr
String ID: 332
API String ID: 3300951897-3855660651
Opcode ID: cb318ee29ff4b70d50a5aa88a21328819fa69738829e59d43219a2b379f4f85a
Instruction ID: 0ac594734c089ca957fd53fd1aaf3adec000987230e20a77b367f42a0daac096
Opcode Fuzzy Hash: cb318ee29ff4b70d50a5aa88a21328819fa69738829e59d43219a2b379f4f85a
Instruction Fuzzy Hash: 7E310876900256BBEB219B68DCC9FA7776CEF44340F044269F9099B282E770ED15C7B0

Function 003D7610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?), ref: 003D7640
_snprintf.MSVCRT(?,000001FF,%s_,?), ref: 003D765C
_vsnprintf.MSVCRT(?,000001FF,00000000,003D1732,?), ref: 003D767E
lstrcmpA.KERNEL32(?,bdns,?,?), ref: 003D76A0
StrStrIA.SHLWAPI(?,00000000,?,?), ref: 003D76B4

Strings

%s_, xrefs: 003D764B
bdns, xrefs: 003D769A

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: _snprintf_vsnprintflstrcmplstrlen
String ID: %s_$bdns
API String ID: 4220314296-741241040
Opcode ID: f403f46c3705a04ed65c703e21a46cff4629d911d7a149d87503122b124a3851
Instruction ID: 77670595b60e41066d344227f095d3daffdf373f939193edde8efd5469b55512
Opcode Fuzzy Hash: f403f46c3705a04ed65c703e21a46cff4629d911d7a149d87503122b124a3851
Instruction Fuzzy Hash: 9E21C477A006586BDB319E69FCC4FEB736CEB44714F04066AF918DB241F670D91086E0

Function 003D3B90 Relevance: 10.6, APIs: 7, Instructions: 82pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 003D3BD8
CreateNamedPipeA.KERNEL32(?,40000001,00000000,000000FF,00010000,00010000,00000000,00000000), ref: 003D3C0F
ConnectNamedPipe.KERNEL32(00000000,?), ref: 003D3C25
GetLastError.KERNEL32 ref: 003D3C2F
GetLastError.KERNEL32 ref: 003D3C46
SetEvent.KERNEL32(00000000), ref: 003D3C56

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CreateErrorEventLastNamedPipe$Connect
String ID:
API String ID: 3507186782-0
Opcode ID: 6508a918885a5a1c871ca5e0909e927984ca0dbaa22b324577ef92e9f5154cb0
Instruction ID: 6e18c24d0fd934b48f95fba5beefbd480f2d4ce9115c69f31724737efa034221
Opcode Fuzzy Hash: 6508a918885a5a1c871ca5e0909e927984ca0dbaa22b324577ef92e9f5154cb0
Instruction Fuzzy Hash: E321C576350206AFE7228F64ECC4B99BB68EF44751F204626FA59DB2C0D7B1ED808B50

Function 003DF2B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003D3810: GetProcessHeap.KERNEL32(00000000,00000000,?,003D4046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 003D3819
Part of subcall function 003D3810: HeapAlloc.KERNEL32(00000000,?,003D4046,?,00000000,00000000,00000000,00000000,?,?,?), ref: 003D3820

sprintf.MSVCRT(00000000,\\.\%c:), ref: 003DF2E9
CreateFileA.KERNEL32(00000000,00000000,00000003,00000000,00000003,00000000,00000000), ref: 003DF2FA
memset.MSVCRT(?,00000000,000003FF), ref: 003DF323
DeviceIoControl.KERNEL32(00000000,002D1400,003E09A7,0000000C,?,00000400,00000000,00000000), ref: 003DF352
CloseHandle.KERNEL32(00000000), ref: 003DF35B

Strings

\\.\%c:, xrefs: 003DF2E3

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heap$AllocCloseControlCreateDeviceFileHandleProcessmemsetsprintf
String ID: \\.\%c:
API String ID: 2995886503-1260769427
Opcode ID: 45330dfae05660c70b44339eec312ffb87198c0e831c5ee0537d35dd81d0d19e
Instruction ID: 12bad932ad225f58d662ae242f4f849a7494a98e8943895a97e5f2289af1f0b0
Opcode Fuzzy Hash: 45330dfae05660c70b44339eec312ffb87198c0e831c5ee0537d35dd81d0d19e
Instruction Fuzzy Hash: 752195F29002587FEB11DF95ACC5EFEB77CEB45754F00457AF608A6281E6B00F8546A1

Function 003DA64A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 18synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,003DE750,00000000,00000000,00000000), ref: 003DA659
MessageBoxA.USER32(00000000,This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!,ngrBot Error,00000030), ref: 003DA66F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003DA678
ExitProcess.KERNEL32 ref: 003DA680

Strings

This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!, xrefs: 003DA666
ngrBot Error, xrefs: 003DA661

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CreateExitMessageObjectProcessSingleThreadWait
String ID: This binary is invalid.Main reasons:- you stupid cracker- you stupid cracker...- you stupid cracker?!$ngrBot Error
API String ID: 2697768853-1169653777
Opcode ID: a5cfc0bbb6f9ce1eaf14213e99751a1bb55a2b6bf98c8d6038dfa9f9c15b2d06
Instruction ID: 74839152eb196b6e4e4579e3b5b3df73638691be99580797c4b794a79f497b70
Opcode Fuzzy Hash: a5cfc0bbb6f9ce1eaf14213e99751a1bb55a2b6bf98c8d6038dfa9f9c15b2d06
Instruction Fuzzy Hash: 84E067357C43E1B6E67257A05D4BF8539185B04F12F250710F325BD1D08AF025804759

Function 003D7330 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF), ref: 003D7351
lstrlenA.KERNEL32(?), ref: 003D7369
_snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 003D7381
_vsnprintf.MSVCRT(00000000,000001FE,003E0AAD,?), ref: 003D73A3
lstrlenA.KERNEL32(00000000), ref: 003D73B2

Strings

%s_, xrefs: 003D7370

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$_snprintf_vsnprintfmemset
String ID: %s_
API String ID: 3230270962-1040268105
Opcode ID: 536da33ee251caa1826b6da7d3ea45735cfc11ddaf55f6fde9000fac5c912f52
Instruction ID: bcf87c851dca9b873a90497d5bb07176677da3f1d14b393eeb859a4476ba7e0a
Opcode Fuzzy Hash: 536da33ee251caa1826b6da7d3ea45735cfc11ddaf55f6fde9000fac5c912f52
Instruction Fuzzy Hash: 70110C7694031977E720E6699C86FF7736CDB84740F0406B8B918672C2E5B09E4087E0

Function 003E02A9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 57memorystringCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT(00000000,000001FF,%s=,003E32E4), ref: 003E02C8
strstr.MSVCRT(?,00000000), ref: 003E02EF
atoi.MSVCRT(00000000,?,http,int), ref: 003E0322
lstrlenA.KERNEL32(00000000), ref: 003E0386
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E03E4
HeapFree.KERNEL32(?,00000000,00000000), ref: 003E03EE
LeaveCriticalSection.KERNEL32(0041B4E4), ref: 003E03FD
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 003E041F

Strings

%s=, xrefs: 003E02B7

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: FreeHeap$CriticalLeaveSection_snprintfatoilstrlenstrstr
String ID: %s=
API String ID: 1805118874-2646424381
Opcode ID: 9782b6aea3b394cab68a1d687117295e2e44150c3da30f32962116118352e35b
Instruction ID: 055f7cd5b5166471076e06e7c7c0e2d4b4ace3ae238faa3cd6f5cf41c6ba3458
Opcode Fuzzy Hash: 9782b6aea3b394cab68a1d687117295e2e44150c3da30f32962116118352e35b
Instruction Fuzzy Hash: 6D11EC75A40269ABDB268792CC81BBE7378EB94300F144769FA15671C0D7B4BD818F91

Function 003DDD20 Relevance: 9.0, APIs: 6, Instructions: 36sleepthreadnetworkCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 003DDD2A
GetTickCount.KERNEL32 ref: 003DDD31
InitializeCriticalSection.KERNEL32(0041A6C8), ref: 003DDD45
Sleep.KERNEL32(00007530), ref: 003DDD6A
WSACleanup.WS2_32 ref: 003DDD98

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CleanupCountCriticalExitInitializeSectionSleepThreadTick
String ID:
API String ID: 544336047-0
Opcode ID: fa3f915c36e92becb304a62d8f08836efe5da1dd8732c3a6bba5796dbd4117b6
Instruction ID: 5e50ba2961e2f3403e61d8d2176927a908d51661619bd1c5c7e6cf318101a3ae
Opcode Fuzzy Hash: fa3f915c36e92becb304a62d8f08836efe5da1dd8732c3a6bba5796dbd4117b6
Instruction Fuzzy Hash: 63F0B4735416949ACE333BF87D8A56E321A5F12374F210713F615CA7F1EB3499808AA2

Function 003D4560 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT(?,00000104,%s_%d,EDB88F28,?,00010000,EDB88320,00000000), ref: 003D45D5
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,003D4BA5,?,?,?,00010000,EDB88320,00000000), ref: 003D45FD
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,?,?,00010000,EDB88320,00000000), ref: 003D4636

Strings

%s_%d, xrefs: 003D45C4

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: File$CreateMappingView_snprintf
String ID: %s_%d
API String ID: 1261873476-1933919280
Opcode ID: 6bff0d8f59c82696245ff2424a048725beccbf7a1a8537736c6ea151bcfb1668
Instruction ID: 3589735130facbc3d8842c1e94acd1d69d8fc8487589de2d3374ef0f1c9b270d
Opcode Fuzzy Hash: 6bff0d8f59c82696245ff2424a048725beccbf7a1a8537736c6ea151bcfb1668
Instruction Fuzzy Hash: 4561E3726006428BD726CF18D8C5BB5B7E5FF84304F18827DE6868B3C5D779A9A0DB80

Function 003DE4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79sleepmemorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 003D9FF0: strtok.MSVCRT(?,?,0000002C), ref: 003DA013
Part of subcall function 003D9FF0: strtok.MSVCRT(00000000,?), ref: 003DA04F

lstrlenA.KERNEL32(?), ref: 003DE517
_memicmp.MSVCRT(?,?,00000000), ref: 003DE525
Sleep.KERNEL32(000003E8), ref: 003DE54E
HeapFree.KERNEL32(?,00000000,?), ref: 003DE57A

Strings

[Login]: %s, xrefs: 003DE50B, 003DE536

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: strtok$FreeHeapSleep_memicmplstrlen
String ID: [Login]: %s
API String ID: 2470415281-2266835287
Opcode ID: 37f44b5027501741385ccb806256ed2f3fefb38ec55eb283ea5d5bccbe4e8dcd
Instruction ID: c4da85a2bd23f508bb960595dd93d31b869bea1dab3f4a657cb9148e8baabe72
Opcode Fuzzy Hash: 37f44b5027501741385ccb806256ed2f3fefb38ec55eb283ea5d5bccbe4e8dcd
Instruction Fuzzy Hash: 8521F3B2600204ABD722EB45FC82FAB77ADEB84754F11451AF9044B381F7B5ED50C6A2

Function 003D1C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW), ref: 003D1C6E
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 003D1CC6
CloseHandle.KERNEL32(00000000), ref: 003D1CD9

Strings

kernel32.dll, xrefs: 003D1C69
CreateFileW, xrefs: 003D1C64

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Handle$CloseFileModuleWrite
String ID: CreateFileW$kernel32.dll
API String ID: 2352564674-2113957990
Opcode ID: a01d63154a453da458be588542e40305e16d35d705be4c740e47213fac1e9841
Instruction ID: e87756ae425e260559b957e36cab693cb03bf4f2649c326e13d4d92f061e6520
Opcode Fuzzy Hash: a01d63154a453da458be588542e40305e16d35d705be4c740e47213fac1e9841
Instruction Fuzzy Hash: 0C0104B26502187FD7159FA9AC86FEF336DAB49324F158319FA15973C0E2705D0543A0

Function 003D6D90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,003D6C55,00000000), ref: 003D6DA1

Strings

Ul=, xrefs: 003D6DDB, 003D6DE9
NtQueryInformationProcess, xrefs: 003D6DB9
ntdll.dll, xrefs: 003D6D95
NtSetInformationProcess, xrefs: 003D6DC4

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: HandleModule
String ID: NtQueryInformationProcess$NtSetInformationProcess$Ul=$ntdll.dll
API String ID: 4139908857-2226115229
Opcode ID: 37bfbb09b333d5dc2aab79b844675fd979570d4566211817a90d6005e6c2c298
Instruction ID: 2e6476766fd6c5a67c2ddb4e3e68555a0b9425335b992cba5fbfe92cc2288f14
Opcode Fuzzy Hash: 37bfbb09b333d5dc2aab79b844675fd979570d4566211817a90d6005e6c2c298
Instruction Fuzzy Hash: C601887374176837EB225659AC46FEA739CCB86769F010257FE08AB380DAB19D0042E1

Function 003DFAA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 003DFAC0
sprintf.MSVCRT(?,%c:\,?,?), ref: 003DFAF9

Strings

%c:\, xrefs: 003DFAF3
[USB]: Infected %s, xrefs: 003DFB31
@W>, xrefs: 003DFB24

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ProcWindowsprintf
String ID: %c:\$@W>$[USB]: Infected %s
API String ID: 3179433310-1980713265
Opcode ID: de4cb217f911267c07fbdb6c424aa604e6b5708369432234cf094d5b46a92848
Instruction ID: 154fb0dfbf760bc08cfb8e0ca589042193a609edd30685933fec8f70c9584993
Opcode Fuzzy Hash: de4cb217f911267c07fbdb6c424aa604e6b5708369432234cf094d5b46a92848
Instruction Fuzzy Hash: E011CAB75001485FC721DF74EC91EBB737DEB44308F04866AFE069A342E631D9518B65

Function 003DD530 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 003DD5E4

Part of subcall function 003D8F50: ApplyControlToken.SECUR32(?,?), ref: 003D8FB5
Part of subcall function 003D8F50: InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 003D8FF9
Part of subcall function 003D8F50: DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 003D9025
Part of subcall function 003D8F50: FreeCredentialsHandle.SECUR32(?), ref: 003D902F

Sleep.KERNEL32(0000000F), ref: 003DD659

Strings

%s:%d, xrefs: 003DD5CD
V>, xrefs: 003DD55C, 003DD5FC
cnc, xrefs: 003DD5D2

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: ContextSecuritySleep$ApplyControlCredentialsDeleteFreeHandleInitializeToken
String ID: %s:%d$cnc$V>
API String ID: 3241915987-1760554709
Opcode ID: 1027fa1f3a627bd8ef692701608cd9e2675db4915c29c4c3c612866076e38c04
Instruction ID: 6459a008c5311a5df8482184d536385244e7266b88598dba91a73554dcaec20a
Opcode Fuzzy Hash: 1027fa1f3a627bd8ef692701608cd9e2675db4915c29c4c3c612866076e38c04
Instruction Fuzzy Hash: 9C41B6B6E00104EBC712DBA9FCC19AEB3BDEB84314F554666F909DB345D631ED4087A1

Function 003D16F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT(?,003E13D8), ref: 003D170E
lstrcmpA.KERNEL32(00000000,block), ref: 003D1754
strstr.MSVCRT(00000000,003E13D8), ref: 003D1764

Strings

block, xrefs: 003D174E
bdns, xrefs: 003D1727, 003D17A0

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: strstr$lstrcmp
String ID: bdns$block
API String ID: 142677638-4143068083
Opcode ID: 098e1908b82a734e3652534f3fe9ff77ce8e7adfd49e450af2b963b352aad5cd
Instruction ID: 76e5064a96464453f375a9fcb4f18ec154fcc4aa391218a038ceb4957787a237
Opcode Fuzzy Hash: 098e1908b82a734e3652534f3fe9ff77ce8e7adfd49e450af2b963b352aad5cd
Instruction Fuzzy Hash: D621C1B6601218BB9B22DE59BC86DBB736CDB98711F04422AFC0197381E770ED1196B1

Function 003D7E20 Relevance: 7.6, APIs: 5, Instructions: 65networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000103A), ref: 003D7E2C
socket.WS2_32(00000002,00000001,00000006), ref: 003D7E63
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 003D7E7A
connect.WS2_32(?,00000008,00000010), ref: 003D7E8B

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: AllocLocalconnectioctlsocketsocket
String ID:
API String ID: 3721573447-0
Opcode ID: 55df459790f8ee0c5d007b57bdd462bc9d7dd14df00b288c810b0c5cc0c721d1
Instruction ID: 6b6dd9eebb4f2ce327a5cf8e8ead0fecb89f6376a4adf87bf3a33ccc0dd29548
Opcode Fuzzy Hash: 55df459790f8ee0c5d007b57bdd462bc9d7dd14df00b288c810b0c5cc0c721d1
Instruction Fuzzy Hash: 8F112931A00714AFC721DF69D849ED6B7A8DF49720F00079AF9599B3D1D2B19C848790

Function 003DE770 Relevance: 7.6, APIs: 5, Instructions: 50registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 003DE77C
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000012,?), ref: 003DE793
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 003DE7B5
RegNotifyChangeKeyValue.ADVAPI32(?,00000000,00000004,00000000,00000000), ref: 003DE7C3
RegCloseKey.ADVAPI32(?), ref: 003DE7D1

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Value$ChangeCloseNotifyOpenlstrlen
String ID:
API String ID: 2592630252-0
Opcode ID: 9b6c5b5f3c7063ed94ca6289b6774207238d01a114866b0c3414f4323c08b7af
Instruction ID: dd74658639e5e8f977568a1b7dbbd769c0a2bf1c2c1903ab1769ee2fe59a25a5
Opcode Fuzzy Hash: 9b6c5b5f3c7063ed94ca6289b6774207238d01a114866b0c3414f4323c08b7af
Instruction Fuzzy Hash: E5011A75340344BFE730DB65DC89F977BACEB88B50F108519BA499B2C0D670E8408B60

Function 003D7700 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000001FF), ref: 003D771E
_snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 003D7738
lstrlenA.KERNEL32(00000000), ref: 003D7747

Part of subcall function 003D4900: WaitForSingleObject.KERNEL32(003D7495,000000FF,?,00000000,756F59EB,?,003D7495), ref: 003D4939
Part of subcall function 003D4900: ReleaseMutex.KERNEL32(?,?,003D7495), ref: 003D497C

lstrcmpA.KERNEL32(00000000,003E1A30), ref: 003D777F

Strings

state_%s, xrefs: 003D7727

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait_snprintflstrcmplstrlenmemset
String ID: state_%s
API String ID: 1716770999-3670522127
Opcode ID: 3dc047f0c122497248d62afd6133ae49dafe62d1829e1c3da6a2ac4d586f06a6
Instruction ID: 31c3f54f4fff1c7080410d8b9a306fa3f77f821215ee00cc0d69d873ed92cb1f
Opcode Fuzzy Hash: 3dc047f0c122497248d62afd6133ae49dafe62d1829e1c3da6a2ac4d586f06a6
Instruction Fuzzy Hash: 030126B69503586ADB21EAA0DD0BFF973AC8B44700F0046E5FA18E61C2F6B06A448A90

Function 003D50F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT(?,00000104,%s-comm,00407AE8), ref: 003D510F
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 003D5122
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003D512B

Strings

%s-comm, xrefs: 003D50FE

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CreateMutexObjectSingleWait_snprintf
String ID: %s-comm
API String ID: 3057366584-1028030816
Opcode ID: 9916b393eab39adcd0a7edaace8d62d6ca61503d76f16c2f07b53934d20b2372
Instruction ID: 3dc124d0faa8228b31b42f0f6cf50e92a7b0d95cf7d9dd465a32c03b3641fa0d
Opcode Fuzzy Hash: 9916b393eab39adcd0a7edaace8d62d6ca61503d76f16c2f07b53934d20b2372
Instruction Fuzzy Hash: A7214D76A802047BD715DB90EC42FEB3338A784701F044AA6F404672C1E7B8DF94CBA5

Function 003D5070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT(?,00000104,%s-pid,00407AE8), ref: 003D508F
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 003D50A2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003D50AB

Strings

%s-pid, xrefs: 003D507E

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CreateMutexObjectSingleWait_snprintf
String ID: %s-pid
API String ID: 3057366584-2694366501
Opcode ID: f2246012bf2935fedd4217bb138b6bed28ab41ac66051b45e6731164bcb4ced6
Instruction ID: 348d16ab7a04935afc6df9d3ec8ab4bcdec5a3975b7afb5e632f2eb56e87ae18
Opcode Fuzzy Hash: f2246012bf2935fedd4217bb138b6bed28ab41ac66051b45e6731164bcb4ced6
Instruction Fuzzy Hash: CCF0E9B2A4424467EB21E770AC8BF96325C9710711F500767F614B62C0E9F599C486A6

Function 003DD760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003D7700: memset.MSVCRT(?,00000000,000001FF), ref: 003D771E
Part of subcall function 003D7700: _snprintf.MSVCRT(00000000,000001FF,state_%s,?,?,00000000,000001FF), ref: 003D7738
Part of subcall function 003D7700: lstrlenA.KERNEL32(00000000), ref: 003D7747

Sleep.KERNEL32(00001388), ref: 003DD78A
Sleep.KERNEL32(00002710), ref: 003DD795
ExitProcess.KERNEL32 ref: 003DD799

Strings

bsod, xrefs: 003DD770

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Sleep$ExitProcess_snprintflstrlenmemset
String ID: bsod
API String ID: 706155222-1315366068
Opcode ID: 04e6a2021b50c2573891f2fee505241d04cec8b68ada6edf30b64157e0f88aed
Instruction ID: 0b298bebafb495438317dbb8095fd133397398f08a3726b65a6db5090b36a4c9
Opcode Fuzzy Hash: 04e6a2021b50c2573891f2fee505241d04cec8b68ada6edf30b64157e0f88aed
Instruction Fuzzy Hash: 07D097738C427073C23323352C0AF8B28389F40F21F020341F905AF2C085E02C8180E2

Function 003DE840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

Part of subcall function 003D7330: memset.MSVCRT(?,00000000,000001FF), ref: 003D7351
Part of subcall function 003D7330: lstrlenA.KERNEL32(?), ref: 003D7369
Part of subcall function 003D7330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 003D7381
Part of subcall function 003D7330: _vsnprintf.MSVCRT(00000000,000001FE,003E0AAD,?), ref: 003D73A3
Part of subcall function 003D7330: lstrlenA.KERNEL32(00000000), ref: 003D73B2

CreateThread.KERNEL32(00000000,00000000,Function_0000D760,00000000,00000000,00000000), ref: 003DE861
CloseHandle.KERNEL32(00000000), ref: 003DE868

Strings

admin, xrefs: 003DE845
isadmin, xrefs: 003DE840

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$CloseCreateHandleThread_snprintf_vsnprintfmemset
String ID: admin$isadmin
API String ID: 3136305548-1977506819
Opcode ID: 8d427f19ec4bf309b6b6e2848fad67793b8194d4e5b4b6e90ce3f87d3742e7d1
Instruction ID: 8ca3d8bb889443fafefec06c2b5a6d122c5eaba09cd5af9cc051cccd970d46ff
Opcode Fuzzy Hash: 8d427f19ec4bf309b6b6e2848fad67793b8194d4e5b4b6e90ce3f87d3742e7d1
Instruction Fuzzy Hash: 3CD0127ABC438076F67227A0AD4FF4A226C2B24F07F644621FB00BD2C1E9F0304049B9

Function 003D2880 Relevance: 6.2, APIs: 4, Instructions: 164networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003D2460: GetProcessHeap.KERNEL32(?,003D20DE,?), ref: 003D246C
Part of subcall function 003D2460: HeapAlloc.KERNEL32(?,00000008,003D20DE,?,003D20DE,?), ref: 003D247E

inet_addr.WS2_32(?), ref: 003D28BE
DnsQuery_A.DNSAPI(?,00000001,00000008,00000000,?,00000000), ref: 003D2939
_stricmp.MSVCRT(?,?,?), ref: 003D294E
DnsFree.DNSAPI(?,00000001), ref: 003D29D9

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Heap$AllocFreeProcessQuery__stricmpinet_addr
String ID:
API String ID: 3002912770-0
Opcode ID: 110f96b6d1d035b685377ec64160652de67e228f322d3c32d59a017b7326408f
Instruction ID: 38759212033da1131396e0bc97618a6a14ba2914d062587d9e048300738c332c
Opcode Fuzzy Hash: 110f96b6d1d035b685377ec64160652de67e228f322d3c32d59a017b7326408f
Instruction Fuzzy Hash: 035103726002009FD722DF59E881B6BB3B5FFA6704F21446AE9859F384E771ED50CB90

Function 003D8F50 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

ApplyControlToken.SECUR32(?,?), ref: 003D8FB5
InitializeSecurityContextA.SECUR32(?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 003D8FF9
DeleteSecurityContext.SECUR32(?,?,?,00000000,0008C11C,00000000,00000010,00000000,00000000,?,?,?,?), ref: 003D9025
FreeCredentialsHandle.SECUR32(?), ref: 003D902F

Part of subcall function 003D8760: FreeContextBuffer.SECUR32(?), ref: 003D8774

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Context$FreeSecurity$ApplyBufferControlCredentialsDeleteHandleInitializeToken
String ID:
API String ID: 362823901-0
Opcode ID: 91d4cefd64efd9f35dc6e2e7fd71609d68d9713618f1c362d00826a8ab29d2d4
Instruction ID: 222deea4a56d929cc604ac231cf9f6bd835c40099294d239dd0bdff599dad9c0
Opcode Fuzzy Hash: 91d4cefd64efd9f35dc6e2e7fd71609d68d9713618f1c362d00826a8ab29d2d4
Instruction Fuzzy Hash: B041E6B2C002099BCB11DFAAD885AEFFBFCFF98304F10450BE515A7251D7B5A6448BA4

Function 003D4900 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(003D7495,000000FF,?,00000000,756F59EB,?,003D7495), ref: 003D4939
ReleaseMutex.KERNEL32(?,?,003D7495), ref: 003D497C
ReleaseMutex.KERNEL32(-0000FFFF,?,003D7495), ref: 003D49A5
ReleaseMutex.KERNEL32(003D7495,?,003D7495), ref: 003D49D1

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 03e03d00c55c86e3f08346e64624f755b73eb8a02ef0a04b17bfb35947deb553
Instruction ID: 774879b5502882f7cb829546dfa968b50194a7cd457289049b977c40c496e372
Opcode Fuzzy Hash: 03e03d00c55c86e3f08346e64624f755b73eb8a02ef0a04b17bfb35947deb553
Instruction Fuzzy Hash: A82121332012468BDB229F66F9A47A777A9EF44364F1A4527E598CB350E730DC51C790

Function 003D49F0 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,756F59EB,?,003D73CC,00407C98,00000000,00000000,00000010,00000000), ref: 003D4A10
ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 003D4A77
ReleaseMutex.KERNEL32(?,?,?,00000000), ref: 003D4AA9
ReleaseMutex.KERNEL32(?,00000000), ref: 003D4ABC

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 19fae008c1d3355fe06379dd5b4b9c663b7e8060e0388ea700377eb7147b0f7b
Instruction ID: ffd71d4d8e88c3e0ef103f4179a7afded8208467eeb158add89af63ab9ec34cf
Opcode Fuzzy Hash: 19fae008c1d3355fe06379dd5b4b9c663b7e8060e0388ea700377eb7147b0f7b
Instruction Fuzzy Hash: 9021A3772042155BDB12DF69FC806AA73ADAF80764B19452BFC48CB350EB30DD4187E4

Function 003DD6B0 Relevance: 6.1, APIs: 4, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 003DD6FD
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 003DD731
RegCloseKey.ADVAPI32(?), ref: 003DD740
RegCloseKey.ADVAPI32(?), ref: 003DD753

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Close$CreateValue
String ID:
API String ID: 1009429713-0
Opcode ID: aa0ebcf9023b687313e33f4e6f6419e67bf2bbed339c76ea2d3e5b6e8402217e
Instruction ID: 8d84dfb25035b07c8a8c8f4df5c59c23d8f27cbee781d791d215bb64bc00250d
Opcode Fuzzy Hash: aa0ebcf9023b687313e33f4e6f6419e67bf2bbed339c76ea2d3e5b6e8402217e
Instruction Fuzzy Hash: 13211D75640209BBDB25CF94DC86FAA737CEB88B44F108244BA05AB285E670FE4497A4

Function 003D7EF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 003D7F06
LocalFree.KERNEL32(?,?), ref: 003D7F19
LocalFree.KERNEL32(?,?), ref: 003D7F3B

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: FreeLocal$closesocket
String ID:
API String ID: 1824021853-0
Opcode ID: 811a052fccb4a2c7277ff8bf255115bb4af3e452b279823391bdb9bb3d32fc52
Instruction ID: 547f32737c9eabcfc03f7655997c600c7525a5753d0ba4d0d4971eb174e2db3e
Opcode Fuzzy Hash: 811a052fccb4a2c7277ff8bf255115bb4af3e452b279823391bdb9bb3d32fc52
Instruction Fuzzy Hash: FE015A327042109FC722DF69E88489AB3ADFF8976535504AAF548CB310D631EC81CBA0

Function 003DA800 Relevance: 6.0, APIs: 4, Instructions: 49stringsleepCOMMON

Download Yara Rule

APIs

strchr.MSVCRT(?,0000002A), ref: 003DA80A
GetTickCount.KERNEL32 ref: 003DA820
Sleep.KERNEL32 ref: 003DA859
strchr.MSVCRT(?,0000002A), ref: 003DA865

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: strchr$CountSleepTick
String ID:
API String ID: 735077530-0
Opcode ID: 95a916ab21c3a4c5f4ade448bca9315db80dd00b46d0f3afbf11dcd3c558da99
Instruction ID: 3751e54321707f846cc19ed66b4f70999004c602f770b3dd7b4a62d543db51da
Opcode Fuzzy Hash: 95a916ab21c3a4c5f4ade448bca9315db80dd00b46d0f3afbf11dcd3c558da99
Instruction Fuzzy Hash: 83F044B72002805BD312A3A4EC86A8A735ACBC4361F000426FE098B341E9B9DE4642B3

Function 003DA790 Relevance: 6.0, APIs: 4, Instructions: 44stringsleepCOMMON

Download Yara Rule

APIs

strchr.MSVCRT(?,00000023), ref: 003DA79B
GetTickCount.KERNEL32 ref: 003DA7B0
Sleep.KERNEL32 ref: 003DA7DC
strchr.MSVCRT(?,00000023), ref: 003DA7E5

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: strchr$CountSleepTick
String ID:
API String ID: 735077530-0
Opcode ID: d5175d9d15ba25bc79b7949ee6de8b6821be008fae62708455ee3cb17fb9c87f
Instruction ID: 077423d258067dd62eb5ef008f9d34a365832d691d0c23cee1c6ffa72f48e2e6
Opcode Fuzzy Hash: d5175d9d15ba25bc79b7949ee6de8b6821be008fae62708455ee3cb17fb9c87f
Instruction Fuzzy Hash: 88F02B7350116267C23363A5FC86A8BB79CDB81761F050662FE059F342E56C9E8581F2

Function 003DA080 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 003DA0A2
WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 003DA0C0
CloseHandle.KERNEL32(00000000), ref: 003DA0CB
CloseHandle.KERNEL32(00000000), ref: 003DA0D8

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CloseFileHandle$CreateWrite
String ID:
API String ID: 3602564925-0
Opcode ID: 22d8b61886b87a830e01c728920a50fdc8c040fe307f2ba66408d6d572892039
Instruction ID: bffdd200ece0db357130af984cceeaa09bb8b769af4e8d727e0d2fddd09671b2
Opcode Fuzzy Hash: 22d8b61886b87a830e01c728920a50fdc8c040fe307f2ba66408d6d572892039
Instruction Fuzzy Hash: 15F06272251218BBEB209B98EC49F9A37ACEB49764F104345FE08DB3C0D6716D0487A5

Function 003E0880 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003D4900: WaitForSingleObject.KERNEL32(003D7495,000000FF,?,00000000,756F59EB,?,003D7495), ref: 003D4939
Part of subcall function 003D4900: ReleaseMutex.KERNEL32(?,?,003D7495), ref: 003D497C

lstrlenA.KERNEL32(00000000,00000000,%s.p10-> Message to %s hijacked!,msn), ref: 003E08B1

Part of subcall function 003D7330: memset.MSVCRT(?,00000000,000001FF), ref: 003D7351
Part of subcall function 003D7330: lstrlenA.KERNEL32(?), ref: 003D7369
Part of subcall function 003D7330: _snprintf.MSVCRT(00000000,000001FE,%s_,?), ref: 003D7381
Part of subcall function 003D7330: _vsnprintf.MSVCRT(00000000,000001FE,003E0AAD,?), ref: 003D73A3
Part of subcall function 003D7330: lstrlenA.KERNEL32(00000000), ref: 003D73B2

Strings

%s_0x%08X, xrefs: 003E08C0
msnmsg, xrefs: 003E088C
bmsn, xrefs: 003E08C5

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$MutexObjectReleaseSingleWait_snprintf_vsnprintfmemset
String ID: %s_0x%08X$bmsn$msnmsg
API String ID: 1310428588-4225137719
Opcode ID: 7164f0d28d32a58bdc0a1155e9582a969a94875bee78ac73b32b97ed0961872d
Instruction ID: 4b93b59b33ebdd88900a91472dd735c4056b830dc042cbe5dec7b8d9457b95fe
Opcode Fuzzy Hash: 7164f0d28d32a58bdc0a1155e9582a969a94875bee78ac73b32b97ed0961872d
Instruction Fuzzy Hash: 27F08977B5512477D72165967C06FFB775CC742721F440252FD08EB281E9E5591002E1

Function 003E0820 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003D4900: WaitForSingleObject.KERNEL32(003D7495,000000FF,?,00000000,756F59EB,?,003D7495), ref: 003D4939
Part of subcall function 003D4900: ReleaseMutex.KERNEL32(?,?,003D7495), ref: 003D497C

lstrlenA.KERNEL32(00000000,?,?,003D2696), ref: 003E084B

Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF), ref: 003D7401
Part of subcall function 003D73E0: memset.MSVCRT(?,00000000,000001FF,?,00000000,000001FF), ref: 003D7419
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D7431
Part of subcall function 003D73E0: _snprintf.MSVCRT(?,000001FE,%s_,?), ref: 003D7449
Part of subcall function 003D73E0: _vsnprintf.MSVCRT(?,000001FE,003E0A8E,?), ref: 003D746B
Part of subcall function 003D73E0: lstrlenA.KERNEL32(?), ref: 003D747A

Strings

%s_0x%08X, xrefs: 003E085A
msnmsg, xrefs: 003E082B
bmsn, xrefs: 003E085F

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: lstrlen$memset$MutexObjectReleaseSingleWait_snprintf_vsnprintf
String ID: %s_0x%08X$bmsn$msnmsg
API String ID: 3682388603-4225137719
Opcode ID: 026e9d5eae97f4dc181fe0a66b6643652badf54fa5d8b41545f73be696f91352
Instruction ID: 8bfdd59451be3d7223b003824c8217f13994b2610a70153b6f298a40b0a71ef4
Opcode Fuzzy Hash: 026e9d5eae97f4dc181fe0a66b6643652badf54fa5d8b41545f73be696f91352
Instruction Fuzzy Hash: CCF0A772A9513877D62276A57C06FFB734CCB02750F400392FC08EA2C1E9E55A1002E2

Function 003DB990 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000003FF,00000000), ref: 003DB9AF
EnterCriticalSection.KERNEL32(0041A6C8,?,?,00000000), ref: 003DB9BC
wvsprintfA.USER32(00000000,?,00000000,?,?,00000000), ref: 003DB9D1

Part of subcall function 003D8B30: memset.MSVCRT(?,00000000,0000002C), ref: 003D8B6E

LeaveCriticalSection.KERNEL32(0041A6C8,?,?,?,?,?,00000000), ref: 003DB9F2

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavewvsprintf
String ID:
API String ID: 2410102678-0
Opcode ID: d7bd0abc830c41c7233242a8b1df6e781d94e1745e7e552622ae01e1ef7b1e08
Instruction ID: a2b5448014980521db12be9b9002531761972bf22449e8e74cbeb7efca1491ce
Opcode Fuzzy Hash: d7bd0abc830c41c7233242a8b1df6e781d94e1745e7e552622ae01e1ef7b1e08
Instruction Fuzzy Hash: 9FF02BB6D002186FC721EB54DC4AFEA373CEF44714F0442A5FF09A6280E6706A458BA5

Function 003DE990 Relevance: 6.0, APIs: 4, Instructions: 31sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0000DD20,00000000,00000000,00000000), ref: 003DE9BF
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003DE9C6
CloseHandle.KERNEL32(00000000), ref: 003DE9C9
Sleep.KERNEL32(0000EA60), ref: 003DE9D4

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CloseCreateHandleObjectSingleSleepThreadWait
String ID:
API String ID: 422747524-0
Opcode ID: 35cf9db4b99066d369870753753d8c73696594d7cd5f1b0fe8b4c058210cd89d
Instruction ID: d16a173858b9c7f2c93da8b63b7953cc17edaa8beede97917cf8f0af3ce791d5
Opcode Fuzzy Hash: 35cf9db4b99066d369870753753d8c73696594d7cd5f1b0fe8b4c058210cd89d
Instruction Fuzzy Hash: 09F0E532241280BBE7335748ACC6F9A775CEB55B61F250216F300AE2E083B42DC086A9

Function 003DBA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

memset.MSVCRT(?,00000000,000007FF), ref: 003DBA1E
wvsprintfA.USER32(00000000,00000000,00000000), ref: 003DBA42

Part of subcall function 003DB990: memset.MSVCRT(?,00000000,000003FF,00000000), ref: 003DB9AF
Part of subcall function 003DB990: EnterCriticalSection.KERNEL32(0041A6C8,?,?,00000000), ref: 003DB9BC
Part of subcall function 003DB990: wvsprintfA.USER32(00000000,?,00000000,?,?,00000000), ref: 003DB9D1
Part of subcall function 003DB990: LeaveCriticalSection.KERNEL32(0041A6C8,?,?,?,?,?,00000000), ref: 003DB9F2

Strings

PPPPMSG %s :%s, xrefs: 003DBA56

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: CriticalSectionmemsetwvsprintf$EnterLeave
String ID: PPPPMSG %s :%s
API String ID: 3980427996-569775469
Opcode ID: bd534779df7b3dff2f78ecaa06ad82968a6eb6db7d458322867536d2f2eb03b7
Instruction ID: 5371e2feafa6e7099e27faa84005ca35ca97dd4ffa2047a96cd6b620ed97881c
Opcode Fuzzy Hash: bd534779df7b3dff2f78ecaa06ad82968a6eb6db7d458322867536d2f2eb03b7
Instruction Fuzzy Hash: C7F096B5900249ABDF11EB54DC45FAA737CFB44704F0081A9F9085B281FB70AA488F91

Function 003D9300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(n"=), ref: 003D9308
gethostbyname.WS2_32(n"=), ref: 003D9313

Strings

n"=, xrefs: 003D9304, 003D9307, 003D9312

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID: n"=
API String ID: 1594361348-1121072393
Opcode ID: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
Instruction ID: c00cc152485c446e76158d36d9bdf46e028dd3ce94080de9f112c61585bf5db7
Opcode Fuzzy Hash: 0dc712adc4df25350ee7766ec22a98ef040dde3b90c5f692ddb856f0b3388dda
Instruction Fuzzy Hash: 1CD05B366009245B4A11A669F4408D9739CDE9A3747054297FA1CDF7E2C761AD4046D1

Function 003D68B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00419E78,00000026,00000001,003DA9CD,?,?,?,?,?,00000000), ref: 003D68BB
PathAppendW.SHLWAPI(00419E78,Internet Explorer\iexplore.exe,?,?,?,?,?,00000000), ref: 003D68D0

Strings

Internet Explorer\iexplore.exe, xrefs: 003D68C6

Memory Dump Source

Source File: 00000009.00000002.621221554.00000000003D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 003D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_QgGhoOpxHPl.jbxd

Similarity

API ID: Path$AppendFolderSpecial
String ID: Internet Explorer\iexplore.exe
API String ID: 2921508639-3330628412
Opcode ID: 511e43a40c4e0e11ba2fa599c1db12fde1527065e1e999db337bfa5b77b54aa7
Instruction ID: a395969fe738daa35dbeabb967f958ecad2bfc347e4bd882bf94ce772fff38b2
Opcode Fuzzy Hash: 511e43a40c4e0e11ba2fa599c1db12fde1527065e1e999db337bfa5b77b54aa7
Instruction Fuzzy Hash: 02C012363C034026EB265A649CDBFC93285A774F82F804612F202EC1D0C3F948C0608B

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25F.tmp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Operating System Destruction

Change of System Appearance

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\MP98E46N\www.msn[1].xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E68EA6F4-C74D-11EF-8F38-ECF4BBB5915B}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E68EA6F6-C74D-11EF-8F38-ECF4BBB5915B}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\Icon[1].png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\YJ1BHFNR.htm

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\common.802715d7a736bd82fc74[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\experience.b374b0d5b40196862f17[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\microsoft.b109cceab5e009228460[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vendors.290823e0e7160e8e5303[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\favicon[1].ico

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\favicon[2].ico

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\jquery-3.6.3.min[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\desktop-shape[1].png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ie-image[1].png

Windows Analysis Report
25F.tmp.exe

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre