GetPhysLong
GetPortVal
InitializeWinIo
InstallWinIoDriver
MapPhysToLin
RemoveWinIoDriver
SetPhysLong
SetPortVal
ShutdownWinIo
UnmapPhysicalMemory
Overview
overview
1Static
static
QQ群发/)...��.url
windows7-x64
1QQ群发/)...��.url
windows10-2004-x64
1QQ群发/Q...�).exe
windows7-x64
1QQ群发/Q...�).exe
windows10-2004-x64
1QQ群发/Q...elp.js
windows7-x64
1QQ群发/Q...elp.js
windows10-2004-x64
1QQ群发/WinIo.dll
windows7-x64
1QQ群发/WinIo.dll
windows10-2004-x64
1QQ群发/WinIo.exe
windows7-x64
QQ群发/WinIo.exe
windows10-2004-x64
QQ群发/Z...es.dll
windows7-x64
1QQ群发/Z...es.dll
windows10-2004-x64
1QQ群发/Z...al.dll
windows7-x64
1QQ群发/Z...al.dll
windows10-2004-x64
1QQ群发/Z...en.exe
windows7-x64
1QQ群发/Z...en.exe
windows10-2004-x64
1QQ群发/Z...LL.dll
windows7-x64
1QQ群发/Z...LL.dll
windows10-2004-x64
1QQ群发/Z...ct.dll
windows7-x64
1QQ群发/Z...ct.dll
windows10-2004-x64
1QQ群发/Z...DK.dll
windows7-x64
1QQ群发/Z...DK.dll
windows10-2004-x64
1QQ群发/Z..._X.dll
windows7-x64
1QQ群发/Z..._X.dll
windows10-2004-x64
1QQ群发/Z...G].exe
windows7-x64
1QQ群发/Z...G].exe
windows10-2004-x64
1QQ群发/reg.exe
windows7-x64
1QQ群发/reg.exe
windows10-2004-x64
1QQ群发/说明.url
windows7-x64
1QQ群发/说明.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
QQ群发/)!访问我们的网站!.url
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
QQ群发/)!访问我们的网站!.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
QQ群发/QQFafafa2.92(企业版).exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
QQ群发/QQFafafa2.92(企业版).exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
QQ群发/QQFafafaHelp.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
QQ群发/QQFafafaHelp.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
QQ群发/WinIo.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
QQ群发/WinIo.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
QQ群发/WinIo.exe
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
QQ群发/WinIo.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
QQ群发/ZProtect1.4--内附注册机/DialogRes.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
QQ群发/ZProtect1.4--内附注册机/DialogRes.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
QQ群发/ZProtect1.4--内附注册机/DialogRes_original.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
QQ群发/ZProtect1.4--内附注册机/DialogRes_original.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
QQ群发/ZProtect1.4--内附注册机/Keygen.exe
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
QQ群发/ZProtect1.4--内附注册机/Keygen.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
QQ群发/ZProtect1.4--内附注册机/KeygenDLL.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
QQ群发/ZProtect1.4--内附注册机/KeygenDLL.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtect.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtect.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtectSDK.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtectSDK.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtectSDK_X.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtectSDK_X.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtect_Remove NAG_BY[LCG].exe
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
QQ群发/ZProtect1.4--内附注册机/ZProtect_Remove NAG_BY[LCG].exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
QQ群发/reg.exe
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
QQ群发/reg.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
QQ群发/说明.url
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
QQ群发/说明.url
Resource
win10v2004-20220901-en
Target
345c805013c22a5196a484b81990860054b08e21bad79c1030fcd0619e44270a
Size
7.8MB
MD5
adf0fbc6225095f2015839a1f18b84b3
SHA1
82cc4ddac7eda834eea69f630a7214a9f3f0d9d8
SHA256
345c805013c22a5196a484b81990860054b08e21bad79c1030fcd0619e44270a
SHA512
7d7e77bd0478fd41c2052b1b630107cee20f23fe8627df51f1c5e700b5f4dede8e67dc9fb417446d5162bbf89c5d5a29992d2f3aa7bd7ea9954c82be77934dcf
SSDEEP
196608:nNy0MQ/yXfq1umWD5zQwuQ25WLDxfC5Sn:kTQ/yvqnYzQlQ3LFf+Sn
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
CloseHandle
CreateFileA
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
DeviceIoControl
GetEnvironmentVariableA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetLastError
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
ControlService
CloseServiceHandle
OpenSCManagerA
CreateServiceA
StartServiceA
OpenServiceA
DeleteService
GetPhysLong
GetPortVal
InitializeWinIo
InstallWinIoDriver
MapPhysToLin
RemoveWinIoDriver
SetPhysLong
SetPortVal
ShutdownWinIo
UnmapPhysicalMemory
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
RtlInitUnicodeString
IoCreateDevice
MmAllocateNonCachedMemory
MmFreeNonCachedMemory
Ke386SetIoAccessMap
IoCreateSymbolicLink
IofCompleteRequest
Ke386IoSetAccessProcess
IoDeleteSymbolicLink
ZwClose
ZwMapViewOfSection
ObReferenceObjectByHandle
ZwOpenSection
ZwUnmapViewOfSection
IoDeleteDevice
IoGetCurrentProcess
HalTranslateBusAddress
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
BuildKeyToBuffer
BuildKeyToFile
CalcNeedBufSize
SetKeyInfo
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
StartZProtect
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
ZP_CRC32
ZP_CloseFileMapping
ZP_DES128
ZP_FreeResources
ZP_GetExecutionTime
ZP_GetHardwareIDStr
ZP_GetHomePageStr
ZP_GetKeyBuffer
ZP_GetKeyCustomInt
ZP_GetKeyCustomStr
ZP_GetTrialDate
ZP_GetTrialDateLeft
ZP_GetTrialDays
ZP_GetTrialDaysLeft
ZP_GetTrialTimes
ZP_GetTrialTimesLeft
ZP_GetUserName
ZP_GetWaterMarkStr
ZP_LoadResources
ZP_MD5
ZP_OpenReadOnlyFileMapping
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
ord15
ord7
ord8
ord20
ord11
ord9
ord3
ord17
ord14
ord13
ord18
ord12
ord21
ord10
ord16
ord2
ord1
ord6
ord4
ord5
ord19
GetStartupInfoA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
MultiByteToWideChar
HeapSize
RtlUnwind
HeapReAlloc
VirtualAlloc
IsValidCodePage
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
ZP_CRC32
ZP_CloseFileMapping
ZP_DES128
ZP_FreeResources
ZP_GetExecutionTime
ZP_GetHardwareIDStr
ZP_GetHomePageStr
ZP_GetKeyBuffer
ZP_GetKeyCustomInt
ZP_GetKeyCustomStr
ZP_GetTrialDate
ZP_GetTrialDateLeft
ZP_GetTrialDays
ZP_GetTrialDaysLeft
ZP_GetTrialTimes
ZP_GetTrialTimesLeft
ZP_GetUserName
ZP_GetWaterMarkStr
ZP_LoadResources
ZP_MD5
ZP_OpenReadOnlyFileMapping
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetProcAddress
GetModuleHandleA
GetProcAddress
VirtualProtect
MessageBoxA
MessageBoxA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE