Gen:Packed.FakeAV.2 (BitDefender), TrojanSpy:Win32/Nivdort.Y (Microsoft), HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Packed.FakeAV.2 (B) (Emsisoft), Heur.AdvML.B (Symantec), Win32.Fosforo (Ikarus), Gen:Packed.FakeAV.2 (FSecure), Win32:Stealer-DQ [Trj] (Avast), Gen:Packed.FakeAV.2 (AdAware), GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Spy, Trojan, Fake-AV, Packed
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 584388a669225b29232c8581a9688424
SHA1: ca0983fc78b3505d22ac2148856f6714314080b5
SHA256: 7f42e92f286d3eb7d41df4ad171476e18943435c4be201866fd1571f981fffcc
SSDeep: 3072:cHEaljAVydnIQnseh1fsppJx7E7kyyFRkTU:cHE4v1hh56Jx7E78oU
Size: 123864 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-05-23 14:46:22
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Spy. Spy program intended for stealing user's confidential data.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1004
The Trojan injects its code into the following process(es):
vmacthlp.exe:936
wmiprvse.exe:468
lsass.exe:776
spoolsv.exe:1448
Explorer.EXE:1684
jqs.exe:1972
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1004 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe (123 bytes)
The Trojan deletes the following file(s):
C:\%original file name%.exe (0 bytes)
Registry activity
The process vmacthlp.exe:936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
The process %original file name%.exe:1004 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 51 1E 68 D6 33 9F 6B BB 0E 32 FC 49 66 4E 51"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GupuQjep" = "%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in kernel32.dll:
CreateProcessInternalW
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1004
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe (123 bytes)
- Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GupuQjep" = "%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe" - Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 1952 | 2048 | 4.34383 | e2a077eabc08414eefabdf27052378b3 |
bss | 8192 | 48 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rdata | 12288 | 664 | 1024 | 2.43563 | 46287cb0c778ae192c2757af9b19fd89 |
.rsrc | 16384 | 100020 | 100352 | 5.54355 | 170d9f71a6a2e400040cefc07cfdf9cb |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
wmiprvse.exe_468_rwx_00DD0000_00027000:
c:\%original file name%.exe
c:\%original file name%.exe
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
.pdata
.pdata
@.reloc
@.reloc
SHELL32.DLL
SHELL32.DLL
msvcrt.dll
msvcrt.dll
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
lsass.exe_776_rwx_00AC0000_00027000:
c:\%original file name%.exe
c:\%original file name%.exe
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
.pdata
.pdata
@.reloc
@.reloc
SHELL32.DLL
SHELL32.DLL
msvcrt.dll
msvcrt.dll
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
wmiprvse.exe_468_rwx_00F00000_00014000:
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
lsass.exe_776_rwx_00BC0000_00014000:
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
spoolsv.exe_1448_rwx_00B60000_00027000:
c:\%original file name%.exe
c:\%original file name%.exe
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
.pdata
.pdata
@.reloc
@.reloc
SHELL32.DLL
SHELL32.DLL
msvcrt.dll
msvcrt.dll
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
spoolsv.exe_1448_rwx_00F40000_00014000:
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
Explorer.EXE_1684_rwx_00ED0000_00027000:
c:\%original file name%.exe
c:\%original file name%.exe
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
.pdata
.pdata
@.reloc
@.reloc
SHELL32.DLL
SHELL32.DLL
msvcrt.dll
msvcrt.dll
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
jqs.exe_1972_rwx_010B0000_00027000:
c:\%original file name%.exe
c:\%original file name%.exe
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
.pdata
.pdata
@.reloc
@.reloc
SHELL32.DLL
SHELL32.DLL
msvcrt.dll
msvcrt.dll
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
Explorer.EXE_1684_rwx_01FF0000_00014000:
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
jqs.exe_1972_rwx_011E0000_00014000:
.text
.text
.rdata
.rdata
@.data
@.data
.reloc
.reloc
u.Sh8
u.Sh8
KERNEL32.DLL
KERNEL32.DLL
%u(%u)
%u(%u)
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
\notepad.exe
\notepad.exe
iertutil.dll
iertutil.dll
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
aSHELL32.DLL
hXXp://
hXXp://
hXXps://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
ntdll.dll
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
CertOpenStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CRYPT32.dll
CRYPT32.dll
NETAPI32.dll
NETAPI32.dll
SHLWAPI.dll
SHLWAPI.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MSVCRT.dll
MSVCRT.dll
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
7&7,747:7
7&7,747:7
DelegateExecute
DelegateExecute
%s\%s.txt
%s\%s.txt
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
explorer.exe
explorer.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll