Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
ZipThis.exe
|
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
|
initial sample
|
||
C:\Program Files\ZipThis\zipthisUserId.txt
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\SMCR\userId.txt
|
ASCII text, with no line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\ZipThis.exe
|
"C:\Users\user\Desktop\ZipThis.exe"
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://www.indiantypefoundry.com
|
unknown
|
||
https://www.zipthisapp.com/legal
|
unknown
|
||
https://www.zipthisapp.com/see-you-later
|
unknown
|
||
https://can.thisilient.com/r
|
unknown
|
||
https://www.zipthisapp.com/legal?
|
unknown
|
||
https://visit.keyguardai.com/click?pid=496&offer_id=14039178
|
unknown
|
||
http://www.colophon-foundry.org
|
unknown
|
||
https://github.com/rsms/inter)
|
unknown
|
||
https://apb.thisilient.com/v6
|
45.33.84.9
|
||
http://scripts.sil.org/OFLhttps://rsms.me/Rasmus
|
unknown
|
||
https://www.zipthisapp.com/policy
|
unknown
|
||
https://key-guard.io/terms-of-use?
|
unknown
|
||
http://scripts.sil.org/OFLhttps://www.indiantypefoundry.comhttp://www.colophon-foundry.orgColophon
|
unknown
|
||
https://www.zipthisapp.com/policy?
|
unknown
|
||
http://scripts.sil.org/OFL
|
unknown
|
||
https://apb.thisilient.com/v6h
|
unknown
|
||
https://rsms.me/
|
unknown
|
||
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
https://apb.thisilient.com
|
unknown
|
||
http://scripts.sil.org/OFLThis
|
unknown
|
||
http://scripts.sil.org/OFLital
|
unknown
|
||
https://www.zipthisapp.com/success?u=wSoftware
|
unknown
|
||
https://key-guard.io/privacy-policy?
|
unknown
|
There are 13 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
apb.thisilient.com
|
45.33.84.9
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
45.33.84.9
|
apb.thisilient.com
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASAPI32
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASAPI32
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASAPI32
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASAPI32
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASAPI32
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASAPI32
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASAPI32
|
FileDirectory
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASMANCS
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASMANCS
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASMANCS
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASMANCS
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASMANCS
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASMANCS
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ZipThis_RASMANCS
|
FileDirectory
|
There are 4 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
7FFD9B60C000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9B816000
|
trusted library allocation
|
page read and write
|
||
1A9ECBBC000
|
heap
|
page read and write
|
||
9D333FE000
|
stack
|
page read and write
|
||
1A9ECFC0000
|
heap
|
page read and write
|
||
1A9ECF7E000
|
heap
|
page read and write
|
||
1A9F071D000
|
heap
|
page read and write
|
||
7FF40D183000
|
trusted library allocation
|
page execute read
|
||
1A9EA89C000
|
heap
|
page read and write
|
||
1A9ED060000
|
trusted library section
|
page readonly
|
||
1A9ECB7B000
|
heap
|
page read and write
|
||
1A9F0715000
|
heap
|
page read and write
|
||
1A9F0631000
|
heap
|
page read and write
|
||
7FFD9B5D4000
|
trusted library allocation
|
page read and write
|
||
1A9F1680000
|
trusted library allocation
|
page read and write
|
||
7FF40D184000
|
trusted library allocation
|
page readonly
|
||
1A9EC220000
|
trusted library allocation
|
page read and write
|
||
7FFD9B696000
|
trusted library allocation
|
page execute and read and write
|
||
1A9ECC10000
|
heap
|
page read and write
|
||
7FF40D196000
|
trusted library allocation
|
page readonly
|
||
1A9ECC2D000
|
heap
|
page read and write
|
||
1A9F05FB000
|
heap
|
page read and write
|
||
1A9F070D000
|
heap
|
page read and write
|
||
7FFD9B7D0000
|
trusted library allocation
|
page read and write
|
||
7FFD9B7E5000
|
trusted library allocation
|
page read and write
|
||
1A9ED037000
|
heap
|
page read and write
|
||
1A9EC270000
|
trusted library allocation
|
page read and write
|
||
7FFD9B860000
|
trusted library allocation
|
page read and write
|
||
1A9ECBB1000
|
heap
|
page read and write
|
||
1A9F067A000
|
heap
|
page read and write
|
||
1A9EA730000
|
heap
|
page read and write
|
||
1A9ECC20000
|
heap
|
page read and write
|
||
7FFD9B660000
|
trusted library allocation
|
page read and write
|
||
7FF40D19D000
|
trusted library allocation
|
page execute read
|
||
7FFD9B759000
|
trusted library allocation
|
page read and write
|
||
1A98050E000
|
trusted library allocation
|
page read and write
|
||
1A9ED170000
|
trusted library allocation
|
page read and write
|
||
1A9EC900000
|
heap
|
page execute and read and write
|
||
1A9ED03B000
|
heap
|
page read and write
|
||
7FFD9B770000
|
trusted library allocation
|
page read and write
|
||
1A9F0588000
|
heap
|
page read and write
|
||
1A9ECEA0000
|
heap
|
page read and write
|
||
1A9ECBA2000
|
heap
|
page read and write
|
||
1A9EA710000
|
heap
|
page read and write
|
||
1A9ECF37000
|
heap
|
page read and write
|
||
7FFD9B5DD000
|
trusted library allocation
|
page execute and read and write
|
||
1A9ECC5D000
|
heap
|
page read and write
|
||
1A9ECB54000
|
heap
|
page read and write
|
||
1A9ECC08000
|
heap
|
page read and write
|
||
7FFD9B666000
|
trusted library allocation
|
page read and write
|
||
9D347F4000
|
stack
|
page read and write
|
||
1A9EA2F2000
|
unkown
|
page readonly
|
||
1A9EA630000
|
heap
|
page read and write
|
||
1A9ECC0D000
|
heap
|
page read and write
|
||
1A9EC0E0000
|
heap
|
page execute and read and write
|
||
1A980474000
|
trusted library allocation
|
page read and write
|
||
7FFD9B880000
|
trusted library allocation
|
page read and write
|
||
1A9F0A54000
|
trusted library allocation
|
page read and write
|
||
9D367FB000
|
stack
|
page read and write
|
||
7FFD9B814000
|
trusted library allocation
|
page read and write
|
||
1A9ECB1E000
|
heap
|
page read and write
|
||
7FFD9B5B0000
|
trusted library allocation
|
page read and write
|
||
1A9807CD000
|
trusted library allocation
|
page read and write
|
||
1A9EA7A9000
|
heap
|
page read and write
|
||
1A9EA7BC000
|
heap
|
page read and write
|
||
1A9ED034000
|
heap
|
page read and write
|
||
7FFD9B5B3000
|
trusted library allocation
|
page execute and read and write
|
||
9D33FFE000
|
stack
|
page read and write
|
||
1A9F067D000
|
heap
|
page read and write
|
||
7FF40D19E000
|
trusted library allocation
|
page readonly
|
||
9D32FF3000
|
stack
|
page read and write
|
||
1A9F0489000
|
heap
|
page read and write
|
||
1A9EC090000
|
trusted library allocation
|
page read and write
|
||
7FF40D192000
|
trusted library allocation
|
page readonly
|
||
1A9EC0F3000
|
heap
|
page read and write
|
||
1A9EA7DC000
|
heap
|
page read and write
|
||
7FF40D193000
|
trusted library allocation
|
page execute read
|
||
7FF40D195000
|
trusted library allocation
|
page execute read
|
||
1A9EA795000
|
heap
|
page read and write
|
||
1A9801A5000
|
trusted library allocation
|
page read and write
|
||
1A9F07E6000
|
heap
|
page read and write
|
||
7FFD9B7A0000
|
trusted library allocation
|
page read and write
|
||
7FFD9B850000
|
trusted library allocation
|
page read and write
|
||
7FFD9B796000
|
trusted library allocation
|
page read and write
|
||
7FF40D187000
|
trusted library allocation
|
page execute read
|
||
7FFD9B7BD000
|
trusted library allocation
|
page read and write
|
||
7FFD9B840000
|
trusted library allocation
|
page read and write
|
||
1A9ECBAD000
|
heap
|
page read and write
|
||
1A9F0A72000
|
trusted library allocation
|
page read and write
|
||
1A9F0658000
|
heap
|
page read and write
|
||
7FFD9B5D0000
|
trusted library allocation
|
page read and write
|
||
7FFD9B846000
|
trusted library allocation
|
page read and write
|
||
1A98060C000
|
trusted library allocation
|
page read and write
|
||
1A9ECBCC000
|
heap
|
page read and write
|
||
1A9ECB10000
|
heap
|
page read and write
|
||
1A9F06C2000
|
heap
|
page read and write
|
||
1A9ECE60000
|
heap
|
page read and write
|
||
1A9ECB96000
|
heap
|
page read and write
|
||
1A9ECF14000
|
heap
|
page read and write
|
||
1A9F1660000
|
trusted library allocation
|
page read and write
|
||
7FFD9B820000
|
trusted library allocation
|
page read and write
|
||
1A9EA80A000
|
heap
|
page read and write
|
||
1A9ECB1A000
|
heap
|
page read and write
|
||
7FFD9B890000
|
trusted library allocation
|
page execute and read and write
|
||
1A98069C000
|
trusted library allocation
|
page read and write
|
||
1A9ECC06000
|
heap
|
page read and write
|
||
7FFD9B5BD000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9B82A000
|
trusted library allocation
|
page read and write
|
||
1A9F0E50000
|
trusted library allocation
|
page read and write
|
||
7FF40D181000
|
trusted library allocation
|
page execute read
|
||
7FF40D197000
|
trusted library allocation
|
page execute read
|
||
7FFD9B5CD000
|
trusted library allocation
|
page execute and read and write
|
||
1A9EA790000
|
heap
|
page read and write
|
||
7FFD9B750000
|
trusted library allocation
|
page read and write
|
||
7FFD9B870000
|
trusted library allocation
|
page read and write
|
||
7FFD9B7DA000
|
trusted library allocation
|
page read and write
|
||
7FFD9B7EF000
|
trusted library allocation
|
page read and write
|
||
1A9EAA35000
|
heap
|
page read and write
|
||
7FFD9B848000
|
trusted library allocation
|
page read and write
|
||
7FF40D185000
|
trusted library allocation
|
page execute read
|
||
1A9ED200000
|
trusted library allocation
|
page read and write
|
||
1A980001000
|
trusted library allocation
|
page read and write
|
||
1A9ECBFE000
|
heap
|
page read and write
|
||
1A9EC953000
|
heap
|
page read and write
|
||
1A980613000
|
trusted library allocation
|
page read and write
|
||
7FF40D1A0000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9B762000
|
trusted library allocation
|
page read and write
|
||
7FFD9B835000
|
trusted library allocation
|
page read and write
|
||
1A9ECBDA000
|
heap
|
page read and write
|
||
1A9F0553000
|
heap
|
page read and write
|
||
7FFD9B818000
|
trusted library allocation
|
page read and write
|
||
9D36FFB000
|
stack
|
page read and write
|
||
1A9801A3000
|
trusted library allocation
|
page read and write
|
||
1A9F0719000
|
heap
|
page read and write
|
||
7FF40D182000
|
trusted library allocation
|
page readonly
|
||
7FFD9B798000
|
trusted library allocation
|
page read and write
|
||
1A9F05E7000
|
heap
|
page read and write
|
||
1A9ECA80000
|
trusted library allocation
|
page read and write
|
||
1A990001000
|
trusted library allocation
|
page read and write
|
||
7FFD9B5DB000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9B6D0000
|
trusted library allocation
|
page execute and read and write
|
||
1A9ED070000
|
trusted library allocation
|
page read and write
|
||
7FFD9B780000
|
trusted library allocation
|
page execute and read and write
|
||
1A9F04D5000
|
heap
|
page read and write
|
||
1A9ECB28000
|
heap
|
page read and write
|
||
1A9ECB24000
|
heap
|
page read and write
|
||
7FFD9B670000
|
trusted library allocation
|
page execute and read and write
|
||
1A9806EE000
|
trusted library allocation
|
page read and write
|
||
1A9ED180000
|
trusted library allocation
|
page read and write
|
||
1A9F0470000
|
heap
|
page read and write
|
||
9D3290F000
|
stack
|
page read and write
|
||
9D363FB000
|
stack
|
page read and write
|
||
1A9F0502000
|
heap
|
page read and write
|
||
7FFD9B7F3000
|
trusted library allocation
|
page read and write
|
||
7FFD9B5B2000
|
trusted library allocation
|
page read and write
|
||
1A9EA7A0000
|
heap
|
page read and write
|
||
9D35FFF000
|
stack
|
page read and write
|
||
9D353FB000
|
stack
|
page read and write
|
||
7FFD9B8A0000
|
trusted library allocation
|
page read and write
|
||
7FF40D19C000
|
trusted library allocation
|
page readonly
|
||
1A9ECB73000
|
heap
|
page read and write
|
||
1A9ECB9D000
|
heap
|
page read and write
|
||
7FFD9B5C3000
|
trusted library allocation
|
page read and write
|
||
1A980366000
|
trusted library allocation
|
page read and write
|
||
1A9F0484000
|
heap
|
page read and write
|
||
9D37FFF000
|
stack
|
page read and write
|
||
1A9EC060000
|
trusted library allocation
|
page read and write
|
||
1A9ECE6F000
|
heap
|
page read and write
|
||
9D35BFD000
|
stack
|
page read and write
|
||
1A9EC230000
|
heap
|
page read and write
|
||
1A9F0603000
|
heap
|
page read and write
|
||
1A9ECE8B000
|
heap
|
page read and write
|
||
7FFD9B7FA000
|
trusted library allocation
|
page read and write
|
||
1A9F06BD000
|
heap
|
page read and write
|
||
1A9ECA90000
|
heap
|
page execute and read and write
|
||
1A9ECF1F000
|
heap
|
page read and write
|
||
7FFD9B7B7000
|
trusted library allocation
|
page read and write
|
||
1A9EA893000
|
heap
|
page read and write
|
||
1A9F1650000
|
trusted library allocation
|
page read and write
|
||
1A9ECB6F000
|
heap
|
page read and write
|
||
1A9ECFBB000
|
heap
|
page read and write
|
||
1A9ECB2E000
|
heap
|
page read and write
|
||
9D343FC000
|
stack
|
page read and write
|
||
7FF40D191000
|
trusted library allocation
|
page execute read
|
||
1A9F04A0000
|
heap
|
page read and write
|
||
1A9F04E3000
|
heap
|
page read and write
|
||
7FFD9B790000
|
trusted library allocation
|
page read and write
|
||
1A9ECBC7000
|
heap
|
page read and write
|
||
1A98058D000
|
trusted library allocation
|
page read and write
|
||
1A9F050C000
|
heap
|
page read and write
|
||
1A9ECC36000
|
heap
|
page read and write
|
||
7FFD9B760000
|
trusted library allocation
|
page read and write
|
||
7FFD9B7E0000
|
trusted library allocation
|
page read and write
|
||
7FFD9B83F000
|
trusted library allocation
|
page read and write
|
||
1A9F26A0000
|
heap
|
page read and write
|
||
1A9F071B000
|
heap
|
page read and write
|
||
7FFD9B810000
|
trusted library allocation
|
page read and write
|
||
1A9ECB57000
|
heap
|
page read and write
|
||
1A9801B6000
|
trusted library allocation
|
page read and write
|
||
1A9ECBF7000
|
heap
|
page read and write
|
||
7FFD9B66C000
|
trusted library allocation
|
page execute and read and write
|
||
7FF40D19F000
|
trusted library allocation
|
page execute read
|
||
1A9F049E000
|
heap
|
page read and write
|
||
1A9ECFFF000
|
heap
|
page read and write
|
||
1A9802F9000
|
trusted library allocation
|
page read and write
|
||
1A9803F2000
|
trusted library allocation
|
page read and write
|
||
1A9EC093000
|
trusted library allocation
|
page read and write
|
||
7FFD9B5B4000
|
trusted library allocation
|
page read and write
|
||
1A9EA7DF000
|
heap
|
page read and write
|
||
1A9F05F6000
|
heap
|
page read and write
|
||
1A9F1670000
|
trusted library allocation
|
page read and write
|
||
1A9ED044000
|
heap
|
page read and write
|
||
7FFD9B7C0000
|
trusted library allocation
|
page read and write
|
||
1A9F0504000
|
heap
|
page read and write
|
||
1A9F16B0000
|
trusted library allocation
|
page read and write
|
||
1A9EAA30000
|
heap
|
page read and write
|
||
7FFD9B7C4000
|
trusted library allocation
|
page read and write
|
||
1A9EA2F0000
|
unkown
|
page readonly
|
||
1A98021E000
|
trusted library allocation
|
page read and write
|
||
9D357FB000
|
stack
|
page read and write
|
||
1A9ECF07000
|
heap
|
page read and write
|
||
7FFD9B7EA000
|
trusted library allocation
|
page read and write
|
||
7FF40D180000
|
trusted library allocation
|
page readonly
|
||
9D328CE000
|
stack
|
page read and write
|
||
1A9ECB9A000
|
heap
|
page read and write
|
||
1A98064A000
|
trusted library allocation
|
page read and write
|
||
1A9EC200000
|
heap
|
page read and write
|
||
1A9EC080000
|
trusted library allocation
|
page read and write
|
||
1A9ECFCA000
|
heap
|
page read and write
|
||
7FF40D194000
|
trusted library allocation
|
page readonly
|
||
1A980604000
|
trusted library allocation
|
page read and write
|
||
1A980744000
|
trusted library allocation
|
page read and write
|
||
1A9EA750000
|
heap
|
page read and write
|
||
1A9ECFC3000
|
heap
|
page read and write
|
||
1A9F0664000
|
heap
|
page read and write
|
||
1A980198000
|
trusted library allocation
|
page read and write
|
||
1A9ECA93000
|
heap
|
page execute and read and write
|
||
1A9801B2000
|
trusted library allocation
|
page read and write
|
||
1A9F1690000
|
trusted library allocation
|
page read and write
|
||
1A9ECBC0000
|
heap
|
page read and write
|
||
7FFD9B7B0000
|
trusted library allocation
|
page read and write
|
||
1A9ECED5000
|
heap
|
page read and write
|
||
1A9EC950000
|
heap
|
page read and write
|
||
7FFD9B7E3000
|
trusted library allocation
|
page read and write
|
||
7FFD9B5C0000
|
trusted library allocation
|
page read and write
|
||
7FF40D186000
|
trusted library allocation
|
page readonly
|
There are 236 hidden memdumps, click here to show them.