Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
NOVA ORDEM.exe
|
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NOVA ORDEM.exe_183265296818dedab7d0b93d41b13e51f02317e6_4b8a3282_5d79ce14-7b1c-47f3-9856-1b13ca046127\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6844.tmp.dmp
|
Mini DuMP crash report, 16 streams, Tue Jul 2 06:22:44 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER69FA.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A2A.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\NOVA ORDEM.exe
|
"C:\Users\user\Desktop\NOVA ORDEM.exe"
|
|
|
|
C:\Windows\System32\cmd.exe
|
"C:\Windows\System32\cmd.exe"
|
|
|
|
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
|
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
|
|
|
|
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
|
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 1344 -s 1128
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
|
http://www.fontbureau.com
|
unknown
|
||
|
http://www.fontbureau.com/designersG
|
unknown
|
||
|
http://www.fontbureau.com/designers/?
|
unknown
|
||
|
http://www.founder.com.cn/cn/bThe
|
unknown
|
||
|
http://www.fontbureau.com/designers?
|
unknown
|
||
|
http://www.tiro.com
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://www.fontbureau.com/designers
|
unknown
|
||
|
http://www.goodfont.co.kr
|
unknown
|
||
|
http://www.carterandcone.coml
|
unknown
|
||
|
http://www.sajatypeworks.com
|
unknown
|
||
|
http://www.typography.netD
|
unknown
|
||
|
http://www.fontbureau.com/designers/cabarga.htmlN
|
unknown
|
||
|
http://www.founder.com.cn/cn/cThe
|
unknown
|
||
|
http://www.galapagosdesign.com/staff/dennis.htm
|
unknown
|
||
|
http://www.founder.com.cn/cn
|
unknown
|
||
|
http://www.fontbureau.com/designers/frere-user.html
|
unknown
|
||
|
http://www.jiyu-kobo.co.jp/
|
unknown
|
||
|
http://www.galapagosdesign.com/DPlease
|
unknown
|
||
|
http://www.fontbureau.com/designers8
|
unknown
|
||
|
http://www.fonts.com
|
unknown
|
||
|
http://www.sandoll.co.kr
|
unknown
|
||
|
http://www.urwpp.deDPlease
|
unknown
|
||
|
http://www.zhongyicts.com.cn
|
unknown
|
||
|
http://www.sakkal.com
|
unknown
|
There are 16 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
ProgramId
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
FileId
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
LongPathHash
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
Name
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
OriginalFileName
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
Publisher
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
Version
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
BinFileVersion
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
BinaryType
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
ProductName
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
ProductVersion
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
LinkDate
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
BinProductVersion
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
Size
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
Language
|
||
|
\REGISTRY\A\{1f78bea8-1360-ce35-619f-8ebb3f1ddf09}\Root\InventoryApplicationFile\nova ordem.exe|12b3dd7daf805cf5
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3B00000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
2571E87D000
|
trusted library allocation
|
page read and write
|
|
|
|
2571E540000
|
trusted library allocation
|
page read and write
|
|
|
|
7FFD9B770000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B78D000
|
trusted library allocation
|
page execute and read and write
|
||
|
372F000
|
heap
|
page read and write
|
||
|
2571CAE9000
|
heap
|
page read and write
|
||
|
7FFD9B880000
|
trusted library allocation
|
page execute and read and write
|
||
|
25736DB0000
|
heap
|
page read and write
|
||
|
2571CA00000
|
heap
|
page read and write
|
||
|
7FFD9B930000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B846000
|
trusted library allocation
|
page execute and read and write
|
||
|
2571C890000
|
unkown
|
page readonly
|
||
|
38D9000
|
direct allocation
|
page execute and read and write
|
||
|
25736DDB000
|
heap
|
page read and write
|
||
|
3290000
|
heap
|
page read and write
|
||
|
25738AA0000
|
heap
|
page execute and read and write
|
||
|
2571CB46000
|
heap
|
page read and write
|
||
|
7FFD9B7BC000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B940000
|
trusted library allocation
|
page read and write
|
||
|
2572E68C000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B917000
|
trusted library allocation
|
page read and write
|
||
|
2571CAC0000
|
heap
|
page read and write
|
||
|
A5D7AF3000
|
stack
|
page read and write
|
||
|
7FFD9B810000
|
trusted library allocation
|
page read and write
|
||
|
2571CCC0000
|
heap
|
page read and write
|
||
|
323E000
|
stack
|
page read and write
|
||
|
2571CD10000
|
heap
|
page read and write
|
||
|
2571E525000
|
trusted library allocation
|
page read and write
|
||
|
2571CB00000
|
heap
|
page read and write
|
||
|
257385D8000
|
heap
|
page read and write
|
||
|
2572E8EA000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B764000
|
trusted library allocation
|
page read and write
|
||
|
2571C892000
|
unkown
|
page readonly
|
||
|
328F000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
2571CD15000
|
heap
|
page read and write
|
||
|
3B40000
|
direct allocation
|
page read and write
|
||
|
3290000
|
heap
|
page read and write
|
||
|
378F000
|
stack
|
page read and write
|
||
|
3C50000
|
heap
|
page read and write
|
||
|
7FFD9B76D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B920000
|
trusted library allocation
|
page read and write
|
||
|
2571CB34000
|
heap
|
page read and write
|
||
|
3200000
|
direct allocation
|
page read and write
|
||
|
3284000
|
heap
|
page read and write
|
||
|
2F7C000
|
stack
|
page read and write
|
||
|
7FFD9B952000
|
trusted library allocation
|
page read and write
|
||
|
328A000
|
heap
|
page read and write
|
||
|
2571CB2C000
|
heap
|
page read and write
|
||
|
3280000
|
heap
|
page read and write
|
||
|
A5D7EFE000
|
stack
|
page read and write
|
||
|
7FF4038B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
25736DC9000
|
heap
|
page read and write
|
||
|
2571CA90000
|
trusted library allocation
|
page read and write
|
||
|
25736530000
|
trusted library allocation
|
page read and write
|
||
|
25737EB0000
|
trusted library allocation
|
page read and write
|
||
|
3287000
|
heap
|
page read and write
|
||
|
2571CBF0000
|
trusted library section
|
page readonly
|
||
|
7FFD9B820000
|
trusted library allocation
|
page execute and read and write
|
||
|
3575000
|
heap
|
page read and write
|
||
|
3A81000
|
direct allocation
|
page execute and read and write
|
||
|
2572E511000
|
trusted library allocation
|
page read and write
|
||
|
2571CB2F000
|
heap
|
page read and write
|
||
|
2571CAB0000
|
trusted library allocation
|
page read and write
|
||
|
A5D85FD000
|
stack
|
page read and write
|
||
|
2571CB78000
|
heap
|
page read and write
|
||
|
3451000
|
heap
|
page read and write
|
||
|
3733000
|
heap
|
page read and write
|
||
|
37B0000
|
direct allocation
|
page execute and read and write
|
||
|
7FFD9B900000
|
trusted library allocation
|
page read and write
|
||
|
2571CB81000
|
heap
|
page read and write
|
||
|
2571E5E2000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B784000
|
trusted library allocation
|
page read and write
|
||
|
A5D83FE000
|
stack
|
page read and write
|
||
|
2571CAC6000
|
heap
|
page read and write
|
||
|
38DD000
|
direct allocation
|
page execute and read and write
|
||
|
2571CEE0000
|
heap
|
page read and write
|
||
|
A5D7CFE000
|
stack
|
page read and write
|
||
|
25737ED2000
|
trusted library allocation
|
page read and write
|
||
|
2573852B000
|
trusted library section
|
page read and write
|
||
|
2571C920000
|
heap
|
page read and write
|
||
|
2572E501000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B78B000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B760000
|
trusted library allocation
|
page read and write
|
||
|
2571CC10000
|
heap
|
page execute and read and write
|
||
|
7FFD9B762000
|
trusted library allocation
|
page read and write
|
||
|
2571CBC3000
|
trusted library allocation
|
page read and write
|
||
|
394E000
|
direct allocation
|
page execute and read and write
|
||
|
3B40000
|
direct allocation
|
page read and write
|
||
|
3260000
|
heap
|
page read and write
|
||
|
2571E501000
|
trusted library allocation
|
page read and write
|
||
|
257385A0000
|
heap
|
page read and write
|
||
|
7FFD9B960000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B763000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B906000
|
trusted library allocation
|
page read and write
|
||
|
2572E50D000
|
trusted library allocation
|
page read and write
|
||
|
368E000
|
stack
|
page read and write
|
||
|
7FFD9B910000
|
trusted library allocation
|
page read and write
|
||
|
3450000
|
heap
|
page read and write
|
||
|
7FFD9B77D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3452000
|
heap
|
page read and write
|
||
|
3451000
|
heap
|
page read and write
|
||
|
7FFD9B970000
|
trusted library allocation
|
page read and write
|
||
|
3AF2000
|
direct allocation
|
page execute and read and write
|
||
|
A5D7BFE000
|
stack
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
3606000
|
heap
|
page read and write
|
||
|
3B40000
|
direct allocation
|
page read and write
|
||
|
2571CCE0000
|
heap
|
page read and write
|
||
|
7FFD9B772000
|
trusted library allocation
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
3B40000
|
direct allocation
|
page read and write
|
||
|
A5D7DFF000
|
stack
|
page read and write
|
||
|
2571CCC5000
|
heap
|
page read and write
|
||
|
7FFD9B950000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B816000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B778000
|
trusted library allocation
|
page read and write
|
||
|
2F3D000
|
stack
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
2571CBC0000
|
trusted library allocation
|
page read and write
|
||
|
257382B0000
|
heap
|
page read and write
|
||
|
2571CCA0000
|
heap
|
page read and write
|
||
|
7FFD9B91C000
|
trusted library allocation
|
page read and write
|
||
|
A5D82FF000
|
stack
|
page read and write
|
||
|
2571CEE5000
|
heap
|
page read and write
|
||
|
7FFD9B81C000
|
trusted library allocation
|
page execute and read and write
|
||
|
257383B0000
|
trusted library section
|
page read and write
|
||
|
2571CB03000
|
heap
|
page read and write
|
||
|
25736DA0000
|
heap
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
A5D7FFB000
|
stack
|
page read and write
|
||
|
2571CACC000
|
heap
|
page read and write
|
||
|
A5D81FC000
|
stack
|
page read and write
|
||
|
2571CA20000
|
heap
|
page read and write
|
||
|
3A7D000
|
direct allocation
|
page execute and read and write
|
||
|
37A4000
|
heap
|
page read and write
|
||
|
A5D84FE000
|
stack
|
page read and write
|
||
|
364E000
|
stack
|
page read and write
|
||
|
7FFD9B780000
|
trusted library allocation
|
page read and write
|
||
|
2571CA40000
|
heap
|
page read and write
|
||
|
3B40000
|
direct allocation
|
page read and write
|
||
|
25736DC0000
|
heap
|
page read and write
|
||
|
3B40000
|
direct allocation
|
page read and write
|
||
|
2572E507000
|
trusted library allocation
|
page read and write
|
||
|
25736CD0000
|
trusted library section
|
page read and write
|
||
|
A5D80FC000
|
stack
|
page read and write
|
There are 138 hidden memdumps, click here to show them.