b08ad594133d88d44c61d70ce19027f372b535863aa6cf1c9ecedcfa9ca45c78

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8097_qip8097.exe
Size 2.3MB
Sample260518-vy2dwset5p
SHA256 b08ad594133d88d44c61d70ce19027f372b535863aa6cf1c9ecedcfa9ca45c78
MD5 fdf4cb087d53fd6e60d86ac62a512b13
SHA1 86a2f2a3414988872e2e78ebc2e090928429ff8a
SHA512 25deba828df195d349aa600b1672d4349649fb9b8d6fd91d48b68d58a910f8b392f583abee95027948da99958fd45cb64cb7f92c5bbb4aa83353a73b54a70b0d
SSDEEP 49152:Q2oRec86wSwR+q14fVBKTsV4HRdBhfykHawSNmy:dYbwSM+q1SB5ahfyQaX
TLSH
T1FAB512D2EA967C39F8E25538CCA79393223EAC51AE738B93705875276FF32C52544306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery installer persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001900000002b4ba-379.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
2400	8097_qip8097.tmp
4600	qip.exe
956	QipGuard.exe
3044	QipGuard.exe

Loads dropped DLL 3 IoCs

pid	Process
800	regsvr32.exe
3356	regsvr32.exe
4600	qip.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\QIP Internet Guardian = "C:\\Users\\Admin\\AppData\\Roaming\\QipGuard\\QipGuard.exe"	QipGuard.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 7 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}\ = "QIPBHO"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}\ = "QIPBHO"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}	regsvr32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b4bb-366.dat	upx
behavioral2/files/0x001900000002b4ba-379.dat	upx
behavioral2/memory/956-374-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral2/memory/3044-388-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral2/memory/3044-390-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral2/memory/956-445-0x0000000000400000-0x0000000000480000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-L8E8E.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-8K0QB.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-HM4Q2.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-577GB.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-1DNBK.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-V4IC4.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\is-RGEF5.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-IG9CR.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-1DCT1.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Sounds\is-1OP59.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\English\is-EAGP9.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\is-P756E.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-15JQS.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-PD5L4.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\English\is-2U3HA.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-HDFT4.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-FSBB4.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-ELI5H.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-Q6N5D.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-1MV7F.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\is-JVR2P.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-S8C7C.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-HCEKJ.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\Russian\is-L7HIM.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-B6RIS.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-S8SEF.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-A0DUN.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-D2T8V.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-72JFG.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-E1DHE.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-HRIFL.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-IBQPO.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-DPU0L.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-T3D8H.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-M5BGR.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-KUD61.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-TAHAF.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-81RI5.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-HDDEH.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\Russian\is-SVVMK.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\Russian\is-VRHCO.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-3ETI4.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-0JL1I.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-DORAA.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-UFOJ9.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\is-HMDSE.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\English\is-JV0TT.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\Russian\is-ME14M.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-G447T.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Sounds\is-E8MLN.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\Russian\is-FTHDP.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\is-CH8I4.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-12UOD.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-VUD8G.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-F1S4H.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-AA2NS.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Static\is-MGKTK.tmp	8097_qip8097.tmp
File opened for modification	C:\Program Files (x86)\QIP\LI\langs.cfg	qip.exe
File created	C:\Program Files (x86)\QIP\DS\is-K39FB.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\LI\English\is-MHJ62.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-MBKBL.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-PGO75.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-K97CH.tmp	8097_qip8097.tmp
File created	C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\is-Q0AGO.tmp	8097_qip8097.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8097_qip8097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8097_qip8097.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QipGuard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QipGuard.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3624-1-0x0000000000400000-0x0000000000416000-memory.dmp	innosetup
behavioral2/memory/3624-17-0x0000000000400000-0x0000000000416000-memory.dmp	innosetup
behavioral2/memory/3624-386-0x0000000000400000-0x0000000000416000-memory.dmp	innosetup

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\ = "{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"	8097_qip8097.tmp
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://qip.ru"	QipGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://search.qip.ru"	QipGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"	QipGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://search.qip.ru/ie"	8097_qip8097.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "1"	8097_qip8097.tmp
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://search.qip.ru/ie"	QipGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://qip.ru"	8097_qip8097.tmp
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\DisplayName = "QIP Search"	8097_qip8097.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}	QipGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Use Search Asst = "yes"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://search.qip.ru/ie"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ = "Live Search"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "@ieframe.dll,-12512"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\DisplayName = "QIP Search"	QipGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchUrl\	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://search.qip.ru"	8097_qip8097.tmp
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\	8097_qip8097.tmp
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://search.qip.ru"	QipGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}	QipGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://search.qip.ru"	8097_qip8097.tmp
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Search	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://search.qip.ru/ie"	QipGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\URL = "http://search.qip.ru/search?query={searchTerms}&from=IE"	QipGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchUrl	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Use Search Asst = "yes"	QipGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes	8097_qip8097.tmp
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\URL = "http://search.qip.ru/search?query={searchTerms}&from=IE"	8097_qip8097.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1"	QipGuard.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://qip.ru"	8097_qip8097.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://qip.ru"	QipGuard.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\ = "QIPBHO Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\VersionIndependentProgID\ = "qipbar.QIPBHO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\TypeLib\ = "{45FF696B-5284-4781-B2CA-ECF3A742A17B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\ = "QIPBHO Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\qipsearchbar.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\ = "QIPBHO Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO.1\CLSID\ = "{95289393-33EA-4F8D-B952-483415B9C955}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\ProgID\ = "qipbar.QIPBHO.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO.1\ = "QIPBHO Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\ = "QIPBHO Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\CLSID\ = "{95289393-33EA-4F8D-B952-483415B9C955}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\CurVer\ = "qipbar.QIPBHO.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\CLSID\ = "{95289393-33EA-4F8D-B952-483415B9C955}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\qipsearchbar.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO.1\CLSID\ = "{95289393-33EA-4F8D-B952-483415B9C955}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\ProgID\ = "qipbar.QIPBHO.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO.1\ = "QIPBHO Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qipbar.QIPBHO\CurVer\ = "qipbar.QIPBHO.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\VersionIndependentProgID\ = "qipbar.QIPBHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}\TypeLib\ = "{45FF696B-5284-4781-B2CA-ECF3A742A17B}"	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2400	8097_qip8097.tmp
4600	qip.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4600	qip.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4600	qip.exe
4600	qip.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2400	3624	8097_qip8097.exe	80
PID 2400 wrote to memory of 800	2400	8097_qip8097.tmp	81
PID 2400 wrote to memory of 3356	2400	8097_qip8097.tmp	82
PID 2400 wrote to memory of 4600	2400	8097_qip8097.tmp	83
PID 2400 wrote to memory of 956	2400	8097_qip8097.tmp	84

C:\Users\Admin\AppData\Local\Temp\8097_qip8097.exe
"C:\Users\Admin\AppData\Local\Temp\8097_qip8097.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\is-32RIM.tmp\8097_qip8097.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-32RIM.tmp\8097_qip8097.tmp" /SL5="$90048,2113394,59904,C:\Users\Admin\AppData\Local\Temp\8097_qip8097.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:800
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3356
- - C:\Program Files (x86)\QIP\qip.exe
    "C:\Program Files (x86)\QIP\qip.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4600
- - C:\Users\Admin\AppData\Roaming\QipGuard\QipGuard.exe
    "C:\Users\Admin\AppData\Roaming\QipGuard\QipGuard.exe" /i 3
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    PID:956

C:\Users\Admin\AppData\Roaming\QipGuard\QipGuard.exe
C:\Users\Admin\AppData\Roaming\QipGuard\QipGuard.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qipicons.bmp

Path C:\Program Files (x86)\QIP\DS\qipicons.bmp
Size 12KB
SHA256 3494c358c572553a42a0476275740f41aa5987d4200c87571b170ed84235e9bd
MD5 ea8de7ab61af5f571901b75ea19c62e2
SHA1 3455665ca770321fb70e86f38a419bc29cd75d47
SHA512 0eeb8a753723d01915549ee62fe5d1c32a5b3ea85c8f80bf035c3c67cdd73c1b5daed2068fbd5e8d41a9aa2a09786edafe05caea9ccb8a6040e8d13a72d969fc
SSDEEP 192:naQkJzUvKSu25I8xr81hfeu8VG19ptpeIjZZVhW+LgWYowv2VpPksdPjK3:mmKB8BcT19jpeIXvpgJoZpPkr3
TLSH
T1D7424AE16B2A93C6F2AD6E59FD49A8CD16C4BE194C98AF833C1BFDCE603C7A50701000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cntry.lng

Path C:\Program Files (x86)\QIP\LI\English\_cntry.lng
Size 3KB
SHA256 3c6bab0820dfb7583d3956804013e36312f51aecfdb574031d59dc1fcf8c94bb
MD5 fd16fd01a402321a60fcf23d3e8a183e
SHA1 641163eca4f35127bf36fef89b7350806221f2b3
SHA512 553e0ae6e35c7065012bf1996764b4dc09dfbb28d805d8f99ab34822c9fccd01280d2a0d75840c6e905c1cdb0229ca62bb2ca1c4466d0adfcc0b49ccb5275525
TLSH
T1A6516365BBF8648EC9F2657F64A1C702D07390607B3EBA820A4D06D93F24ABD5725D33
MD5 SHA1 SHA512 TLSH

Submit Download

_intrsts.lng

Path C:\Program Files (x86)\QIP\LI\English\_intrsts.lng
Size 642B
SHA256 5e8adcde7a861ec0ef831dfdea650faac3427f2a06d2680666422f9f14d6f02f
MD5 14db36572ff358f5a476790c164b33e6
SHA1 c9a7caf5e58efcb77125df3232fe0b110403a706
SHA512 f2e71bbcdd066aa6394d922f9bdb4c6e284200ba356cd80abbe46878ac186c5264b117d0868cef799a3109e52bf5e87c3a986eb1bb3225d253280b6b40ca167d
TLSH
T1B4F0626BEBE083F797E2419069805092E375C08123218C342FD43189338910F2F30B3C
MD5 SHA1 SHA512 TLSH

Submit Download

_langs.lng

Path C:\Program Files (x86)\QIP\LI\English\_langs.lng
Size 730B
SHA256 b83209b47e818ff4e54f0e201eb46e666adba7ff67bbef37daa41025e3db4960
MD5 bdd69ed1878c86e518fd89823e04893f
SHA1 53246c9ba7480c9f95fbfd7d0f8271b0140fb258
SHA512 5f91d6b29aa51f5b17531945fbb02d3c2a1cd9c8762d67296cbc5953262af3a41df48f512f04d5d4ac5ffa773968773c4e45c7b1add307d9ab627c6ec286d4ce
TLSH
T1F101C073D4C5F073423F64CED95281D29662F9E11C135B2648EE12C89706A1C3B12A21
MD5 SHA1 SHA512 TLSH

Submit Download

_marital.lng

Path C:\Program Files (x86)\QIP\LI\English\_marital.lng
Size 145B
SHA256 2548cc8168389f7423eecdec3719fb60afccdec0d6390e2069533d23f566f10a
MD5 df6a49bb3beeaad30151e7f52fb303d9
SHA1 db2282a85f83d6e43fc19ff5ff486d20bcbb19d7
SHA512 bbfbeb8f32cd0f13888dc1308e6b31d77d9d1f182f539b09ea4bbcaea4cece82f37dce7ed6c1fb26705d02ff828bcae1c81b3e73f8584632724cc39a32ca3aa0
TLSH
T199C02BE8531053A01C1BCEF33AF041202074C0563A0FB62404E75090E3458DF001FBB1
MD5 SHA1 SHA512 TLSH

Submit Download

_occup.lng

Path C:\Program Files (x86)\QIP\LI\English\_occup.lng
Size 465B
SHA256 06ec42338c96f56ef782faf33fc71bc94a356548a3938df77ea82ba84188ef32
MD5 893e49c0c3b40668a13465da9df7301f
SHA1 11e9e38a3d01f0baf29e0b622b5afe084e8de588
SHA512 37d98acaf90e8f5eaead2deb38672ddceaf9e36a03a46a041387942aaeb07b0178a15fdc07f08c0cf1a3cbe943341b31ac3eb09844d9dd742f8b6e90bb24043c
TLSH
T136F0D45C89D1857353F3404176218184D29695239562AD64CDB0D54857C094EE732333
MD5 SHA1 SHA512 TLSH

Submit Download

_orgs.lng

Path C:\Program Files (x86)\QIP\LI\English\_orgs.lng
Size 411B
SHA256 629cecd8254d07ed21a4df75e9e6f6d3ad875759d52f46f99576c8eb3f0952bd
MD5 abc4e86f41655d885b1631875faa4dfc
SHA1 150a2ef10118b0199a360ad2f350f7f2f1832f26
SHA512 484692ede0147b9662bf9a3b61acd088a9b8b9c7c5a67543f00349fe09c0f31c39296d6c32f0d9e1b7d711877567aa253432a930b750425f95eab2072f7998d2
TLSH
T150E06862D1A151D003E1E0FCF2467E603CACA9F33C430E434CE0168C5393A593C2EB11
MD5 SHA1 SHA512 TLSH

Submit Download

_past.lng

Path C:\Program Files (x86)\QIP\LI\English\_past.lng
Size 166B
SHA256 949bb4fca80289d43f0aedb0b5ca7061690e2dd3d564b3918fe764f4162c58ee
MD5 ee75bf0e1721d5f7c7bfa7bbe81c5e44
SHA1 196568a7fea1d9efdf220bee48a9912728947805
SHA512 d28384cd7ec269f7f54443c59028315774d9139a079f3484ceb73ade4b64642dbda5322e91a43e448dfa842515121bec21650d44b1d3a710663fdbe00c37fb23
TLSH
T158C08C5DDB868685528F94D4B22006212A38A2521443920028FB6C08A24A7CE021AB70
MD5 SHA1 SHA512 TLSH

Submit Download

_rndchat.lng

Path C:\Program Files (x86)\QIP\LI\English\_rndchat.lng
Size 179B
SHA256 e36542e571cd7ca7a4294b786639ca2ed32938da0c51eea801a2ef36daabfc25
MD5 391538091f1e941089fb38ff0af1a16f
SHA1 8df2bf04765adac25801f66e605293ae67678398
SHA512 2f898f67767dbffe7b337e3f422fdeb7ad28f35d99c98ffbc64c4be237bf75ee3e0c6bd7430fa1b6b0b50003694cf011db486056e236ab901a2c47d4bceee4b4
TLSH
T1DCC08CEA66C0B1A324CA60E075907308C8F2C083AB2281380437338EC3809FA4277FBC
MD5 SHA1 SHA512 TLSH

Submit Download

lang.ini

Path C:\Program Files (x86)\QIP\LI\English\lang.ini
Size 23KB
SHA256 1ce20d5651b984ee0ffd41dbf6c1bf9385b651fe7b96891942e2668f0394118b
MD5 25aea4bedab2985157ce0bdc91cf8488
SHA1 3fa99b55b61336e358287b486447eebc89e7d936
SHA512 e0a017a858130af2b5e932d09d2e79dc5bf813e5e9016e56211a7af4e9670d325b12030739ba00721c07db0798c52d75921b2cc32d7d4b4ffd9e62d01a87bd17
SSDEEP 384:06Gf59uykBosK2WeaB77Fs2zalMhWDVafrHHEBFWPxYC9s1lBY376o:5Gf59unBZK2F47Bs2zalMKVafjHEXWJt
TLSH
T1C1B20957950A24970ED30197FA02B562FFB570886323353AB6EC808C33DF5EE972B695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

current.cfg

Path C:\Program Files (x86)\QIP\LI\current.cfg
Size 12B
SHA256 5c0a7b0069f1cfdba25fd7c23022c08b1aabd2fda5731fe79ebfd2c6bf4bcc98
MD5 b987ee16d5320d9c1cbcc13a915f3b02
SHA1 e9cba9e91fc24f0d1092aac102ed070578bd3e49
SHA512 e11fd5b7566a4a092819b3b4936dd2e0f63abd5b6f050c997126ca850373ad7d86555338608d775b3c2054868de9d4500c726c70c6496eb0cdf56baf9a4f6e6b
MD5 SHA1 SHA512

Submit Download

docking.dll

Path C:\Program Files (x86)\QIP\Plugins\docking.dll
Size 60KB
SHA256 cff686ad048c9d7db12113f2fcb0947ba03c0186cb6daefc1bdca9e2ea395e7f
MD5 bf49f5ac4bcda179d3e2af86dd92ae7d
SHA1 715ad84d9eaf7ef52bcf97d5477d3cdcd4f07965
SHA512 d5f9c60272dfea4609f9cc3e00aea4b36c1df716af015b58e2b1f5124039fccd9b879dce8abca0954b4b86c8ed748ac698e9837faf7c1d621b1fbfe2f23e2da8
SSDEEP 768:0O1uVg17CZCojegVKLxAwbITiXjugNgvLiws8U4n1p0L2D0DfOxCU:Nmm+ZCeVKLxfGiTu8gvLiwjU4kbDfOd
TLSH
T100537C52B59284F3C54E87356895A71BBB7F95000BF086C35F690B9EEE323E16A39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_define.ini

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\_define.ini
Size 459B
SHA256 664b70de552cfbf0821777002f286388ef493edace3448f1108257c44283f54f
MD5 fb86ceb46f7160749d48bc133061c578
SHA1 bc8a988d1ffaac75830d704062f0cb2e63c93894
SHA512 93f5caad86e91e56d61c5ef4b84c55ab7d012f1de62e4f6cbb6dff4b898f4cabfe670e9a3f7f54c732471904002669883839093e7f4b5133f3f63a7af6780a7f
TLSH
T1F4F0A312C0DF45B5A48161C07325E98DB9702CFB3D7835B45A5128C55D3C1195D4FBF8
MD5 SHA1 SHA512 TLSH

Submit Download

aa.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\aa.gif
Size 7KB
SHA256 1a2e9d5dcb824070dc321fcfb963d7a2ee307d785af4a5690f89f331dba8b8d9
MD5 e539a99d1a06e7227f96c1d6986dae52
SHA1 2491e6fdfab73921161f1cf45f99718cf31b6885
SHA512 6e124fbcefafd56d95ff285d81281d688e3782e43531a1354b0bd2cb2321bdc75bd6bee94f26e8f7f05b905bba11077cbaded72970adb654039063b8edf042f4
SSDEEP 192:9YdQ+Bi5XGKi5+dw9HG9/9RQ+Bi5XGGiQi5+dU:9YLW6K1va9G
TLSH
T17DF1C87855868BE2F5AEDDFAC8C09E7F032AD8BB35D010C80E5B5041191F7DE86CB599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\ab.gif
Size 2KB
SHA256 274d0af255571ddbb4219fd7f7a296d150900502f48872800952a2c33f73b17a
MD5 b43fa6d6ab0257a517f0f78fde546cc9
SHA1 fe3e97514fd357913b76dd94b995dde70c381f13
SHA512 9ed39285dcd19e20b6b31fc0d0cab8ed05f9f0bd79b45965f2851553e6dc9226842463ff22113fe6aab3b3599a5b1dd0b0bf9252a8e8a43fe34d22a0918de032
TLSH
T1454158695241EA57D0C83EF8E40C471BA73BEF1541AB42B924D8D2735FA73E9E1090D9
MD5 SHA1 SHA512 TLSH

Submit Download

ac.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\ac.gif
Size 2KB
SHA256 ddb4b878a067038e2c8776fbdc174a8bf3fc6cc836a00e62e83e1f170d16285a
MD5 5832e71b29a655f63bc1e930557583c5
SHA1 7e8ff24cf429c7cbac5fadb312d63ee636dd2e17
SHA512 4e1ac00a91de201d039e0a15a079bf10fa4469741f744e80ea4ffd8c4c4072debe5f20188a4d89fec0f4d7ae1fd91a2e8dcaf7b4d5d315e70177816947d28842
TLSH
T1854173092B8766C4CB5BADF5CA17833A2A78A97307C0C9E1CDD12374F6BE96E080424C
MD5 SHA1 SHA512 TLSH

Submit Download

ad.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\ad.gif
Size 2KB
SHA256 ec195866e0183119b2a6a6e8d16024c5b07b9286790c6a07e5566a8c48d1b147
MD5 1ac8c97e54b743e9a37d9e41f1429ed1
SHA1 8effdf80034b6a77a8785b74a6b33a235209cbd7
SHA512 b4ec1ed15c5416a565f831b6e35c5839c4e9ecaf49dda14583ca84733c2c1039cc2a3c2c507be5aa58754320e20b8f6bee3947d69409e481945281507d0a37dd
TLSH
T186415447E0BA288BE5EAE5B30572B11347807305E3E95996651A07337C5F1B7690BC0A
MD5 SHA1 SHA512 TLSH

Submit Download

ae.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\ae.gif
Size 495B
SHA256 f3706ffb539ac569a749d66471c184f6cd7f5d157f43bec08cb1ec753adef002
MD5 636997164f245419f1d672b1a14ac431
SHA1 733e6209ee62239e052d974b6676cee4374b5ed2
SHA512 628a57a08fb8d3fde77c910eae458b773baf68ccc2bd3cdb5fd4b4cec4a7914c73d0a693722b5f4e05ef3865c1ed7e0d8862ce47b5cf7a443476bc78c4fc2db2
TLSH
T100F09E9D2A9A0845F4AA103F98532799C43CA692C909D85A86BCB40820752FF6D2567A
MD5 SHA1 SHA512 TLSH

Submit Download

af.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\af.gif
Size 6KB
SHA256 4d94a6a29127a46cda1992c9f527b283bd8ee7ba7c3be081322420be18006173
MD5 c8bfb4300c168697405cda1140bf7a5d
SHA1 d1afc38d630037af4b1f31a81b6efc2747a2926c
SHA512 1b651c2902a5b899b7629f20bf262de404e62474027fa218eabe02ead89115dd9de242799bfd6006854ecdc92d1393a5a2e3e6d73d31ca198fa2a97ff8fe3c60
SSDEEP 96:LADSXB/k6zm/8fF+ylPfF9N8fFtifFC8fFtlPfF9NPfFV8fF+ylPfF9N8fFtifFL:kj6zYzyNNGrGNNjzyNNGrGN+tq7p
TLSH
T1C6E14450B93DAC2CDFB8447E2F784994B114C1A445234635964DE73BFC1171B1A8EEE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ag.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\ag.gif
Size 1KB
SHA256 d057204b91006fed93c912098cd9d62d44711a89358e93172c314a27e1004ea7
MD5 64c10c2aeafa9db25fcfdee4283bdc35
SHA1 bc2858fd7537c5ea6d6170723389a777b28b11f8
SHA512 f8b95db337e62c0978b4952aee7d34b393ecf4b0f309f430ab5c05b86c9d0eadff4fde0f0a559ced991ac3bf7b6e38c92ed7b742910f391b8736fcabc9c3b1cc
TLSH
T1132194A7A86B13C9F0452BBEC6B96ED9873D018A474C229AE590C910232506B6BF3109
MD5 SHA1 SHA512 TLSH

Submit Download

ah.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\ah.gif
Size 6KB
SHA256 b0ce3ddad46a04ad2330efa681a37d0b4ae11ba1578683a9331daaa09dbf365b
MD5 ffe4d8279588007ea0845dc1553acacd
SHA1 fd6d4858c8c75d86de937eb8e1befbedc11fcc67
SHA512 e8f9f11c3ec9a84e77c0dad78c02688738125e1aabf8d839744298880639fdc134a8cf5d080b9c8b92b5420b871f015f3919adc9a00097eace1df2e094523922
SSDEEP 96:IHJuikY+LqUrHR+1CFqULJU8NiQ209A2+Z9A2eiF9eHBh1KHqWhXRpQ9:2JuiT+Lf16CFqUtU26tMReKehpO
TLSH
T1EEE11CD5B42CAA5FE1E47EB49F4983D5A3941B74291DC0C73A00A18CF4E73ABA5417CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ai.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\ai.gif
Size 3KB
SHA256 8083df14bbb79a2f263dbc777a2236ee9d6d7a4532cbd03c4c7f680cc5d00b51
MD5 2b4c0169f56eec4dcfacb2938c837dc3
SHA1 9c9380413fc39e63e160299ac9a7024f8aeee000
SHA512 03de6affe368d2bda2a3d6e6f4b957ee492953e51b6993f3faa2342f85142c55866e3a738c0699b4b92ae9027bc132974f42be2a85fddf424ab200694fe0d790
TLSH
T1377174D2891CD521C49C6FF92D3EF3064D70D9A2C324B4140DDA564A1C2EA78CE67F94
MD5 SHA1 SHA512 TLSH

Submit Download

aj.gif

Path C:\Program Files (x86)\QIP\Skins\ICQ5\Smilies\Animated\aj.gif
Size 7KB
SHA256 e24628b606b3274e84ab58af1048787f080944401ae3651369030d82627fc64a
MD5 da975d6e5ec85e99304b44c1ee6f0d80
SHA1 6fc56339bdb4833b6cd88d1f7f6e8e09ccd16040
SHA512 19994f22eb314042f79c94caa4a03c47c45fb0d848d664a6a26d97ae5f36e6fbf5074b63fe459155ba3ffbc4b59096205975cbf93d97cc6631250bcc60838f4f
SSDEEP 192:Ow32d+9tRJvN5775rJvL53XLE1Qwyz3FBcBj4X57f:Ow32gtbv7xdvpvQ2j
TLSH
T163F1F8437837DA0EFC7E6DFE5E338A4B553809E562359782F8005A077C5BCCC919A295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addopt.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\addopt.bmp
Size 14KB
SHA256 99c42396a60e8ba63cb475adb72319adb99a1cf0cc87547660a0353be58f285c
MD5 cf54c65772c731ef37b68f75da3755ec
SHA1 2e4c6cdf67b78a90af550768553a40c523bc01fa
SHA512 f7030ffdd26f3c1bc11664e6cac30ab2b2029becc9c0eb2bce67fc4f51ecfbf3822a2c334554a56a47d74675be91629db16bbabc8ed66d95d8a6acbdb0a0ef2b
SSDEEP 192:Wu/j7ClUBDJZV3OifLm696ZUwmDxXooofpft53V/l:R/julUhJ+gVUZUw4hHoht53Vd
TLSH
T16A62BD13F4C0B29A844418B7ECA464DDBEA9FEE08D3E461754C13DF66ABED5C02E0979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

allicons.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\allicons.bmp
Size 26KB
SHA256 41e84c1bf0a80b5c3026d157521db2a78506cc90ef8be3a0c455d3976346363e
MD5 a72ac022a3e9722eba29455f1fd5b31c
SHA1 26f8a5e58b1919cccd224def9cb3dbc3dedb0e2b
SHA512 8948c4658f25ecab8a966edb0108f02600f0c0ffe4a014a9eeb68e34a6460679ec58fc10b211519748631b2fab23fa10eb86682767cb3b5ed32d13980eea999e
SSDEEP 768:Ume76IasFuWq1PelMCkWOdc38NSr3ASu/DHDv4EPvzRAi5UJUDcjV:UhajWP9JR
TLSH
T12DC2DB6BC0F05C9FAE8AD2690A7471F4E6853810D47F0DB59272CBA49012AEF64FB5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clevent.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\clevent.bmp
Size 15KB
SHA256 982dbb98d21c62125d76399632b046e0b201b5ead7ce984e3bed630971c8c1c3
MD5 14597f44444a3d152312f313a7cc3bb4
SHA1 03816eaaaaebc20e53205fc2bedd3c6017b9283d
SHA512 1a4267b9b7e788f81fe09995956cb9411ac5643da2173ac0523df779db8aa522964d8b1ed6b0aee6c553b4d6ffe99086ee5dcac1bf9a329b7ae7e65d2fa6d0ef
SSDEEP 192:hddcGZCrXbazqMMdv7wMMMMPRtMRMTIxZ6KeDGoPb1IpISyqiJbvoyVkfoLc000T:jcHMKCIuKeDjPbuByzv7KQ
TLSH
T1A462770A926451A844BB6266DF6555FC22A83CF9DF8399E709FF3D9D8B73B200014B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clstatus.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\clstatus.bmp
Size 13KB
SHA256 6844f3e0a84bfd464bec79df337b735e1111c946c59cd12cfe724dd340ace1f5
MD5 99797461c3f92b9ad842400294aee5ad
SHA1 29d9a574342a5a01d24ee103349081d21e6dd8c5
SHA512 71d83351dc165642acb8d4d659cc43f5aea94d53de596337dc2a5ae8ec560ec14a664b26d9bb690416bef75e1034c59ff0c6380605a71c4178e5bf83e2401b4f
SSDEEP 192:uHRyzXYFvs7PrJde5GGC/QVJNZKnAe/BZp:SRyzXMs7PrJdRGAyLKnAaX
TLSH
T1E652CF37D8308C9C9E9108F5E8F924E5ED81746DF98D849F61EC9DAA04091FF18EB463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downbutton1.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\downbutton1.bmp
Size 3KB
SHA256 af6237b014e33d9d8e3c1afc2ac0b5d01ad5d9b9c4d612aa2311901e59fc9407
MD5 66e1a3a4c04d5f6c6b2da1ce3d3f7f26
SHA1 339f2e793173427bcc9867c924375fd77f00340f
SHA512 46ee32b1f6f97206dfe96369b9294eadbb79df64159d33e1d82ffe23294769993618e6474a335af31986f0aadd97d42fe0df19efe36494067829a6678fbc320e
TLSH
T193518466E1A6631F959D8C2ADC4500DF5B8AACDDBF405BF31091B8B4A1FBA4D50CC3E8
MD5 SHA1 SHA512 TLSH

Submit Download

fadehlp.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\fadehlp.bmp
Size 60KB
SHA256 7dad8ae2175baa5b027aa1df85dd08c2fc3b6201dc1a55d8dba572a29b5ac0ce
MD5 7346494f62468e084cb55ad48f9ab03b
SHA1 4050c9bca13e82976c4e7fad720f2d7cd4d7b1f2
SHA512 cdc17c9242da086a9805dca2ba55708ce2243d6511132549b177b04f62c93492a6a621d9d74980a74bdc2beac0ded1ffc8ac3a74c5371e0578fa7498b987e63d
SSDEEP 1536:JjPVrupiA6ghmmienxL3OQWrJirhZG1IbZB:ihZB
TLSH
T16A53029A6E1FCC7377980E548C7B7D7A64A887E5319827F9363E4C1039C06E444EEA72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fadehlpt.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\fadehlpt.bmp
Size 8KB
SHA256 35a6de9f08890087543faf55f32afad1ea6e667d4f88b36142622c8fdb14987f
MD5 e5f1b3f6f18164a358e0f7d2edad4228
SHA1 4559628da1002c9b76aa81e625077a773fb69a39
SHA512 6663cc163e86d39bd57a3d5e9de76a3bb84bf32ac32ac5b6ae0f25f45c2b8b2c860a2d9a23622a47549b4812819d9d42bb3e6ba7bd53910e801754e57ab5d8fc
SSDEEP 192:d0Zco6NOr9bMk97Xg44JYcJI0Hl1hNfQ6Ug7KGgu0KfWqSgB:dqHplNP4l+0HDnI6UgGG6KOcB
TLSH
T1AF02FA5EF497EB55222DD0EACF5F88CBFA5CA36580B219616A3712F0C68023C85DF1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fademsg.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\fademsg.bmp
Size 60KB
SHA256 8b182a8f8dd98e76775d05e6663b39acc560050f101ea1e5075d044fab07a9ed
MD5 393d87e40ca0cc769c3b65a43a3cf729
SHA1 651f6616ae9f74b2d61c5d738a33422b54b3477a
SHA512 2a7344753c3dd18a341a5e776bcba931606532c091cebf639a49d19920f79d7f22a80e588bac4155df6924447affb99b649ec61d4bf196a7f5e614065c6f733a
SSDEEP 768:XVCHczTCCS+sKUE5HOVsmCf1L5Mszx47/gTR:XVCHwZOVsmCt9Msl472
TLSH
T1EF53AE58C60A50065C7B21ECCD16098BE4DA6D2CB0BAA75A5FFD7036F73A63310B259F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fademsgt.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\fademsgt.bmp
Size 8KB
SHA256 fb82388b736cca80791b4d25cce1c725b509c12594628b5650b8a79e073f4bf6
MD5 230a564a13939c2647ec0d7ba12583a9
SHA1 50c74a7b3f6992e9d61664b363ffc2f780af2060
SHA512 ed1800e6599f5b9a98f34550d69a492b429566dccf379e498322d22c7d6ababc956674819b8db77aa129b2732cd28d68553f9f6b502a337af91f5883db2e9214
SSDEEP 192:d72+WJPDcgmWgtK+qo50j+rvSm1TNS9nf5:d721JPDcgm1/qJjyvSmZg9nf5
TLSH
T19202BFC9E95C3E964333C57552C6BA14A44C366F5EF12862E43B9008775AEAB38F348F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fadesrv.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\fadesrv.bmp
Size 60KB
SHA256 282ac92c533d9ef9c32d8cba8f6fa511a7cbe029fdccffb00f060de58fd0d01c
MD5 5b2ef94a693dfac550f77ba8f164f92b
SHA1 a306685688fc0cbfbd15507187f985c8467ede8e
SHA512 9d5c9ece2bb7d9940c6c79214797224e8bf41850fd2a216156dc665ab4931a050b6f6cf56bcad7a72338741875f550df58a9beb2ae87579e1da3bf9fb3d77c48
SSDEEP 768:TqQ8XU8U4NoiZt7YPQG7hb8wCipKMHbsj7Scw5:TUG7hb8wCipKMHbsPScw5
TLSH
T19453796FE3AD8F2B6C2924712A69090BA7D8F4874036D7C43376DE5FC0CB6221657B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fadesrvt.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\fadesrvt.bmp
Size 8KB
SHA256 73cefcbb99f7a0cb7f7d6f98ca75e8783586c9eabaac0fba3e7b0b0e98634330
MD5 6b41826936423872984f739232bbab7f
SHA1 eb87fcc848ca81b90f9a9ff51e328aa6946e0cf5
SHA512 6fdd8c6fc8e4c16c0038a7fb8cb317f32b38f823fc159df4fa2ba06702ecd8b26f4986e811f4e8034ffc6dbc65527ec55482f298f272e9b02fb38e09c31a8853
SSDEEP 96:gensGjsGr9h/EV4HoqnJJCexGxosuH1aAApWrGgSc0bqqsE57vYJjjOyxW+krlQU:dnsAsqwV4pXgAzrGgEqO7y3ulE0K/qDN
TLSH
T16A029082C2DED28D2E72152C15685A0D678C8D1D8A85D7FC578F15C6CFE6B024F9CE6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgbg.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\msgbg.bmp
Size 7KB
SHA256 1fb7b188a02b8f476bfb6703d7f585cd56d7f36828888ef26008445515bf2ec6
MD5 a6b2698041decea6d9a209493da153e1
SHA1 4ca399bc10b3c66727601da869c0e715ac7e4496
SHA512 874da32eb33696e31421f1113e0c8f56f77aa2f5f5272d6f830e37c890e9029bc293cd8a9e8d74078a59c77917e34a28d940ecb0866b049efe3778f54691e31b
SSDEEP 192:bnd7xCDADQQQQKVSZIj5eI9/kvILfYgluMA/zGB5r32Ij:bndsDA+Syf/kvItYMA4KIj
TLSH
T13CE19F6A87205D36E9509E552C2C2618FBC8FDDC312CB2DCEC197D673AFB9B6612C109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

noimage.jpg

Path C:\Program Files (x86)\QIP\Skins\ICQ5\noimage.jpg
Size 2KB
SHA256 87426a7cbe02080f0b8da590c04e6a37e79e60d920147c1b8416a50f8f9001d5
MD5 98c38b8c3d14d38a926d5f3009c693e5
SHA1 eae3fa525771a413b75bf4a47e467b0d138d6037
SHA512 037f7cac910b80b996ba7de3e0aea9d24f044a0cbee1ca2349ed4e1257d0321136b862956b22308fd9c8fa709af5884639a172e340616b07eca878079c22d544
TLSH
T13C410937AA17BC3DD9D15E72C60EDF02870615A665170DE6A43E303DF15512269CB902
MD5 SHA1 SHA512 TLSH

Submit Download

qipbtn.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\qipbtn.bmp
Size 1KB
SHA256 4f44e3174a10b2268553c856d7c29082d90ae37c0da256c055bb250d94a17bef
MD5 8517f566b167a29e94ac2c20d04e43f2
SHA1 ac1ea3f5f095fc989cdb5f9b0e6e4911718e2711
SHA512 17f34633b6548306c979f6911330a9f391e17e7a3f88649ff7a5d81fd05cd11592df7c553096f6ee1073975c438e83b3334ea7517e1c3364682a8d58411e9338
TLSH
T102312557A00149D3C88957B0EDB835EE704D2C4CFE1B78CBE6B37E5AAC375431698192
MD5 SHA1 SHA512 TLSH

Submit Download

splash.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\splash.bmp
Size 38KB
SHA256 ec91a1c64e54a6d3c73af29fa126ad48fc4645be6a05b52fa4bff268b6edabf0
MD5 577d0ae3cdbd514f349f5e5deec16dce
SHA1 d9deda746aec6023529861bb3a5d256d87df6091
SHA512 e1a256bf5c29712faf0e7f58830d82def9cfec553f9576778961acebe70e9defe474b0c7d005eb7c28440e3f7d5db8229684ef60b9c2506b0678007d0a3d3805
SSDEEP 384:utJ3Vpaz9FNL+KwbN/TKVhP5qCNYKbMxmOYYyXG:iTaz1VwbNrKPECNtMdD
TLSH
T1470306315E9242476160BB29BF87E0505767E16FFE8F5A28C03C776B4F66F406BC2168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st_custom.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\st_custom.bmp
Size 25KB
SHA256 f3bb8232cd6d7c5a4dc6d1f120e83effdd245c2225b5218b0f34622129cd855b
MD5 dd21a0679b0154dae318102fe02eb932
SHA1 f548145e85000fcaec9c1aeb07b7abe6b9f30426
SHA512 22d64755dc1235cff5423a572ac65ee7845ad819aa930395f3c35296cd563fb61b90281b58c49804192eb793649d623dc99583907fbcb67abc7a07951024f3e9
SSDEEP 192:MilGXvIfioNm6avRMGswfIIR9RWWIImzyLIIYFi7PIIwS/oII8qIISELKj9ovc4Q:DlGfI03sO+1m37iS/52LKj9+EbVlb
TLSH
T11CC2311AA2B5B48AEEC05A7CDDB173EE15A13DC4CF1D85A300E73EFF54721999A0143A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

title.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\title.bmp
Size 236B
SHA256 390fe7d5cb01e8e95b3684c06ebeec7811c18eb6b80c56f6819b43ecc99202e5
MD5 e37ac1243a91c58c4daa47a75342d445
SHA1 6331d1aa9cae3edf5fede382a5ef2226b443eb39
SHA512 5ba481ec38150bb99405efebef85e9751a158c89ec25a56880754bf8f234d62f5810e9411675e0b3ccb74372294c43e4ca35786ca2e4b52905a78f6448120284
TLSH
T1F7D022E23B482C28E8EF0C34728EC78782E25F00D3A3966200277BC0485A28C0C838CC
MD5 SHA1 SHA512 TLSH

Submit Download

tray.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\tray.bmp
Size 9KB
SHA256 2bfe389d54be3f9197bd4e10ef76560d1bf7fd94c6eaef17146cf57c0bec60c4
MD5 4e8d10ad64a06d49d64a2bf9192e8ad6
SHA1 bfe51b62b37a4624c9c7cfc9cd103e73063047e8
SHA512 94eecbd0a8ae706f0687bbeb489306677e2150714498db6886a029ab3554ba2f82f1dfcf9f05f41dfe70881d85342a848dd7b079fa671a50d9a6aeea17527d82
SSDEEP 192:uEhgrzgNONIvg8Y5755v5StVVt1cuQoMCWOi2A:xN+mgt6tj7i2A
TLSH
T18312DA27DC584AECDBA5DCB44CBD61F0D40978B8FF5D4CD68A38199D048A5DF108B8DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upbutton1.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\upbutton1.bmp
Size 1KB
SHA256 a8a5e0d649b15d0fff131c3c4f4b03f1492ee8d8a072ff54fbb5583292f3f107
MD5 505b35cbe40cd84672849f3fbe2730a5
SHA1 10fe09a94cd77f692e9818837d94a51b77e94ac2
SHA512 60814c7d922a93bf9264899b8d93a2792aa58d1f391155adea025915b455841f305e75f0cd1dfe93b786ecc7f9e9aad7e8c097bab86b5e37fc99a10aca3e857a
TLSH
T12D31DC19AE6CD794DC321478EC368CDFC4C17D995C067883D741BA1EA8B4BAECA8C195
MD5 SHA1 SHA512 TLSH

Submit Download

upbutton2.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\upbutton2.bmp
Size 1KB
SHA256 b255452828f75eb47f1d234afdcaf240a9e92a2695b3e1a54f6c4e8c4dcf501b
MD5 efeff6e2467782f3cf4c293b9c91b378
SHA1 f27d673519ecae0b812222e666380f1a26e2e531
SHA512 40f9c9a2f684460bc9ac519eb1c2ea9eb507957809c2910f02ebe648d604b7bff23bbbde919646390ebc0cae5c20aa0fb13ee144680dc1f6a4595bf6d52af214
TLSH
T11241E84B3618910799950121FEBB5DEE50D7FDC1CD6D3227A8E63E06733A01AD482AFE
MD5 SHA1 SHA512 TLSH

Submit Download

upbutton3.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\upbutton3.bmp
Size 3KB
SHA256 2f943739a980ce4e2729d3890bc525a1c170749a7f56fefef318e1f1dbd37595
MD5 0fec46e5e65f8d3910fb5a89302624a1
SHA1 3d126e2aa1262d162242301b6a11782de87750a5
SHA512 7dbb96f74a27ee6e076ce6e1a5c1266e21281024e587642b437fe9fae3de03e03937f8345e59b2c5d687b12fd6e2d6b8e6de285982d2b4cb1744164e787de386
TLSH
T1CC51192063FA575D89C3DC5BCD768CECC2264CD48E81234F8F7E3225A93D09649326AB
MD5 SHA1 SHA512 TLSH

Submit Download

userinfo.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\userinfo.bmp
Size 9KB
SHA256 c54c7bb6de772c0da0fbf73f7146296e65e884ed61a86161a027b2e62f2b96b0
MD5 4e2eea4f4274b95f48751fd614b4f268
SHA1 5410a6566b67db467e9385e004f10c496651642f
SHA512 2b4d20f93912cc6312abb182682521fb266248fd02293dd98aba0dc654e395b1447f9ddab66e9d925fa6026504e4d939c56abb73911ca2fc72b8de64c31208e2
SSDEEP 192:Mo+OX6/Q0CTHEJNz3eGwpqHoZavL3ViUgk/Te0eM8q30ua:MpCI0/sJzfG
TLSH
T1EA129E27F0E07752530430E9FD6628EFC727BE568E2A06DBAA44F914B279075D6C4B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vis.bmp

Path C:\Program Files (x86)\QIP\Skins\ICQ5\vis.bmp
Size 2KB
SHA256 7a76280a1afe9ef000194c8d7bec688bd22bebd21615821ea27de7ebbcdf8ae7
MD5 3b7df8bf62d480b51208c5d73d2b8e82
SHA1 73688e6bc2175c9c0201606e1a14370fdd4f8c35
SHA512 4ca6373b616eac040ab27c3470f0e40c7da47a1492358691a494965a335cdca084d3af2c8296bb2000fd48875ae1cd1ec3617ee8549ddb13b7af064bf3f384b6
TLSH
T1D95145A3C1BA50AC6925D237427D9CC62881705BC11DC68948AC9F17EEA48FF0AD73C5
MD5 SHA1 SHA512 TLSH

Submit Download

current.cfg

Path C:\Program Files (x86)\QIP\Skins\current.cfg
Size 9B
SHA256 db733c1d608da41b3ad26f54e953c75de2aea504882065350768f7f3d1ab047c
MD5 6af7bea94d8997decc7d5930daa1caa5
SHA1 ec5bb0a86c07fdcf9240b4a90d58657a6e99ab1b
SHA512 889b610d3451b4e80fd9252d24a957ffafe75c0ab0e665cdfdc8369c0f5846d53ca8b1b337f46bde78454df9af4e39e2e5c286016b570dd7ece808828be4b257
MD5 SHA1 SHA512

Submit Download

qip.exe

Path C:\Program Files (x86)\QIP\qip.exe
Size 3.2MB
SHA256 3da76f87cebdb77495b2023b2afe9a5ebbd46815baf905f31ce3acada97bc447
MD5 dcc697d2b0f27a61a7bb50a7f015e0c0
SHA1 d0c905fc4c8a6e8447d156c64af12bebba9c39dd
SHA512 f5f844db95a0916d1b6639c3c5b04c9470e52fc1f296cd70478b46ded4e465926a0a2ea054e89b91bc570558c37f8b9d71e0ee0eae91d6ea396857e6f2917d88
SSDEEP 49152:SEB2q8tZPkHBLjuRWWqMO7YtdUb0artkZBaZY6OTsXWR/foam:SEB2ZzkHBLjQWWq1YLfGY6TWRK
TLSH
T153F57CA7B741D437CA535A38CC1B92E86429BF207E30945776A53F4C6FB8282793D287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8097_qip8097.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-32RIM.tmp\8097_qip8097.tmp
Size 686KB
SHA256 6064593c7c2d21487a8724289a8d44114540b992fba38ddfa6c555136cdbd48b
MD5 8348e97acfc7a84d29412d60337ff548
SHA1 277fcfaf2beceb95880a77d0bd4f0decddf75e17
SHA512 688444847c9e1dda57dafc92bae2b12d8b7bf837531cab6e90ac5ce882480800c01f3b40671ae27af85a2f2e504830fb6467bb507b379cf4dab794a4a3351538
SSDEEP 12288:o0QfKb7nH5lrPo37AzHTA63I0ihE4qE7prN9cgKARpkZXYcXEx9k7:8fKbT5lrPo37AzHTA63/cfqAcgKckZIE
TLSH
T164E47C32F2A0D833D1B31E749D1B82955936FE103E39A5A736E91F0C4F79681792B2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.dll

Path C:\Users\Admin\AppData\Local\Temp\is-DAC59.tmp\chrome.dll
Size 18KB
SHA256 316bc22759d84bae7472ec2f3cf167a099fdd803727c86d001a4d926e700d85c
MD5 34604f9943bce1e88b6ef57812294604
SHA1 e7fdcbbd0246944b785f497f4e0108fa16e19fae
SHA512 00828e8fe279d901ae3dea0114c5ca2a3bd544c892ad10bdcb217dea04b127422a1df9ca4ec14a6fb8720fe210dcc903b409fc498870aa8bc530fad6c7911682
SSDEEP 384:4KRdCyC4MqlWdmQqydJB4fanf7mFZp/vnAzu1xuMTckn:fCycqlUmQBKyn4Z2u1xuuck
TLSH
T153824987F5E29572C060DFBC89A5C22DEB3F7A202E4B6495E9E52DCD9D8E354210C24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qipsearchbar.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
Size 135KB
SHA256 bae518677271c03bfb1d02b0045ed5531178822cc5c961a574332d4bac4e98aa
MD5 a4742311bfc531c8d8af89f8c52f47a0
SHA1 ef0b122d631c39630cb70411fba050430a60257c
SHA512 5b92a25714f846925924302378a38a57000b9b7883107f8a9230d5ea422121740eb07c100bb2fe3d1b7ac83319661bd934669687ff18b83e99a5f674f7fc4904
SSDEEP 1536:yKPese4SV9DCSOKOEo7i7L0mwixhxz4tgxRER8hhTM332ueJI1XZtB3n33++Luet:yKfSZDomeitzdb3TM3326hBX3u+LuU
TLSH
T168D36C107541C036F8BF14BA9D7EC529A62DB9314B6954C7BBC80EAE8F755E2BE30243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\j2hb45w2.Admin\prefs.js
Size 651B
SHA256 a46b47b1baa850bfc26c1888335cd5e2700165467c3b2b349e4b5dcb4c568bf4
MD5 aa6b549f87da3e594d76f5f7f78d94bd
SHA1 9a7c4445954c9f0fd9cb2c890a2712bd5251ea61
SHA512 85d97c39647e7d3e9df6250a3c5102c870adbf6195d7efdc4d9f7e566c101b30450816d3ab9d23f225db6fa9939910cc2e3ea6496991924ad15654f46d78c20d
TLSH
T16BF0D3FDED050A5F1BB27514349D03A356A381BF3DFF0840157568401304F68525D5EF
MD5 SHA1 SHA512 TLSH

Submit Download

qip-search.xml

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\j2hb45w2.Admin\searchplugins\qip-search.xml
Size 2KB
SHA256 dc0383073b34aa3cd45b130c18a9de950ae7c0fffa0d9ba08ef73f73f7afd377
MD5 d535526eb063645049a8b821e62917dd
SHA1 8bc95f56984a86e76abb233803f91f47592782bd
SHA512 b3da1e57b12b5c6bba6bc270a1e4d0a542f3c0eca989e204db35a9e1a5c6baf0cba05bcfe555b37eee7642390300a318b8722187c042f451e9f1eaae4fde05fc
TLSH
T10541DF72A5C1CF861EADC015049DAF4B1F22079BA3480A4ED1E06D322E51F426CDD16F
MD5 SHA1 SHA512 TLSH

Submit Download

QipGuard.exe

Path C:\Users\Admin\AppData\Roaming\QipGuard\QipGuard.exe
Size 184KB
SHA256 bb4ae203ff2295b4dc6b5a04732df388bfc85a180ca6c387315c1b2c85a48889
MD5 ad5e5c3a1eeb166cb00535221f9ce667
SHA1 8505b8f0b16dc06e76262a6a85b383846399ee87
SHA512 9a0534979471c286747940c5aae020289ed0c0015248af881a4db7ee490b24a2a4dab23a093f8670d2445402cd0f33a87b0e545a36d490d4d447c3d387342611
SSDEEP 3072:+vj8C0LjngzZmuUa38UHp9/PEszAlQeV6v/sb2WsrIaqKd+8oFMAV:mw/g9muUabJ9HPzAlR6v/SVKIZ
TLSH
T1FB0412A6DE430B69E05939B547625A3A3B0CB451DB142EA3F344784FBE59270087BB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\QipGuard\sqlite3.dll
Size 273KB
SHA256 e09ccc2a2771cd4d19fe8f02ad9c5a3523920db100f9b8968d91beaa62969478
MD5 a0f13bf547a57d1d15030b69af372c05
SHA1 7dd0a00dc961afc0ec35a5a192a222de250884c5
SHA512 b0c589486c56fce40b43ffa896168e30d1176984f0e4c8c9cbf8a4d773d92631ac939b86e7a9e7e401f97618361f060faf1f220300847ee1d23bfe2033b644a4
SSDEEP 6144:mjMu9mMebdrWBk9Et09oN+EXgKSSCQzEb9KEQIqe1ivV/CMQAwDIR:mgOe5iBk9mjVTCgA80aV/oD+
TLSH
T1EF548BD2BA967C4DFDE7463CC8B393A3117DAD90EEB397839024A5235DC7AD12984306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-445-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/956-374-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2400-16-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2400-335-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2400-19-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2400-8-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2400-377-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2400-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3044-388-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/3044-390-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/3624-17-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3624-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/3624-386-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3624-1-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4600-448-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-446-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-450-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-454-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-456-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-458-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-460-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-464-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/4600-468-0x0000000000400000-0x0000000000736000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads