IOC Report
V2-Office-C2R-Update-16.exe

loading gif

Files

File Path
Type
Category
Malicious
V2-Office-C2R-Update-16.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\configuration_secpod.xml
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\nstB5C0.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\V2-Office-C2R-Update-16.exe
"C:\Users\user\Desktop\V2-Office-C2R-Update-16.exe"
 malicious

URLs

Name
IP
Malicious
http://nsis.sf.net/NSIS_Error
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
420000
unkown
page read and write
20AF000
stack
page read and write
19A000
stack
page read and write
440000
heap
page read and write
2250000
heap
page read and write
5AE000
stack
page read and write
401000
unkown
page execute read
42B000
unkown
page read and write
407000
unkown
page readonly
630000
heap
page read and write
400000
unkown
page readonly
418000
unkown
page read and write
270F000
stack
page read and write
439000
unkown
page readonly
401000
unkown
page execute read
5EE000
stack
page read and write
2280000
heap
page read and write
414000
unkown
page read and write
439000
unkown
page readonly
409000
unkown
page read and write
600000
heap
page read and write
21EF000
stack
page read and write
434000
unkown
page read and write
450000
heap
page read and write
47A000
heap
page read and write
407000
unkown
page readonly
20EE000
stack
page read and write
409000
unkown
page write copy
260E000
stack
page read and write
9B000
stack
page read and write
400000
unkown
page readonly
80F000
stack
page read and write
470000
heap
page read and write
47E000
heap
page read and write
437000
unkown
page read and write
There are 25 hidden memdumps, click here to show them.